This section is at https://rollingedition.com/data-governance-as-code/governance-end-to-end#enforce-one-access-decision.