Follow a control to the code that supports it
An assurance claim should lead somewhere concrete. Wildo places named control references beside the code that supports them, so an engineer can follow an objective to its authorization checks, audit records or data-handling rules.
The reference gives implementation and assurance work a common language. Review still examines what the code actually does; the marker makes that examination traceable.
Example — Review who can administer a customer workspace
A reviewer follows the privileged-access objective to the function that enumerates current administrators and owners. That population supports the review; the review decision and its retained record remain separate evidence.
For engineers
Start with the named objective
The real privileged-access implementation identifies its objective in the source. Its result deliberately separates application administrators, customer owners and customers that could not be inspected. Selected declarations from privileged-access-review.backend.utils.ts:
// assurance-control: WILDO.ACCESS.PRIVILEGED_REVIEW
export interface PrivilegedAccessPopulation {
readonly observedAt: string;
readonly applicationScopeConferringRoles: readonly string[];
readonly organizationScopeConferringRoles: readonly string[];
readonly applicationScopeHolders: readonly PrivilegedApplicationAccessHolder[];
readonly organizationScopeHolders: readonly PrivilegedOrganizationAccessHolder[];
readonly unreadableOrganizationIds: readonly string[];
}
Review the behavior the marker points to
The backend startup diagnostic is a concrete caller: it resolves conferring roles from the current hierarchy, supplies the observation time and invokes enumeratePrivilegedAccessPopulation. The enumeration reads usable account and membership populations. The resulting population is input to an accountable review, not a declaration that every listed permission is appropriate. Keep the decision, reviewer and follow-up work in the application’s assurance evidence.
Keep the references checkable
The repository checker validates marker syntax and objective membership and separates external mapping terminology from runtime controls. It also checks that its workflow covers its scan roots. Run pnpm check:assurance-control-boundary when changing control markers. Passing this check establishes referential hygiene; behavioral review and evidence establish the control.