Network Operations

# policy.md — Network Operations
scope: network-ops
regions: [NG, GH, CI, CM, SN]
owners:
  - ops-director@mainone.example
  - compliance-africa@mainone.example

## 1. Jurisdictional routing
- Every action is tagged with a region claim.
- DRE refuses cross-region ExecutionOrders where DPA prohibits them.
- Data residency: per-region steering vector variants, compiled from a
  common base policy plus region-local overlays.

## 2. Action classes
- Observe: telemetry read, alarm correlation, incident triage.
- Advise: recommend remediation, draft runbook actions, notify NOC.
- Act:    restart service, failover route, apply config push → requires
          NOC-engineer claim on session bus.

## 3. Safety bounds
- No destructive action during declared maintenance freeze windows.
- No BGP withdrawal without a two-engineer quorum claim.
- No customer-data read outside the declared incident scope.

## 4. Audit contract
- Every action emits a trace entry signed by the region-local vector.
- Region regulators receive a monthly digest of action classes + counts.