#321 First attempt at domains, controls and structure

[jpgough-ms]

No description provided.

[yt-ms]

Explaining what I am meaning by some of the terms:

• Control Requirement: this is a high-level statement of what is needed, e.g. "all code in production must meet appropriate architecture quality characteristics (a.k.a. NFRs)".
• Control Instance: this is the way a particular requirement is implemented, and there may be multiple of these for a single requirement. E.g. "All systems in MyDepartment are reviewed by an approved architect before entering production, and a record of that is captured in the central review log repository".
• Control Evidence: this is the data that shows that a particular Control Instance was satisfied. E.g. "On 2024-05-27, jpgough-ms did an architecture review of MySystem and approved it meets appropriate AQCs, as evidenced by document http://myfirm/reviewlog-123" (except expressed as data rather than text).

[yt-ms]

There's also the potential for automated testing of the evidence, which might be done by a REGO expression in the Control Instance operating on the Control Evidence data (with hooks to pull additional info from linked repositories).

[jpgough-ms]

Couple of things to change on the PR based on this feedback:

• Add evidence-id and evidence-link if @yt-ms agrees to the general approach
• Move the definition out of nodes, so it could be referenced from relationships if we decide to go that way