A filter that was supposed to apply to every customer-facing query was applying to none of them — and the governance report said everything was fine. It broke at the exact moment someone corrected it properly. Here is the failure mode, why "green" was the most dangerous possible output, and the design rule that prevents it.
Scope: a defect in my own open-source governance code, found and fixed in the open. No client engagement, system, schema, or data is described.
This page needs JavaScript for the full teardown. Without it, read about DataProof or email Krzysztof.