3. Testable, implementable, and executable controls
At a completed assessment, record Pass only when every applicable mandatory criterion and required evidence element is satisfied, including the listed prerequisite statuses. Otherwise record Fail. Record Not Applicable only when a recorded Applicability Rule evaluates false, with its reason, rule reference, and supporting facts. Unresolved applicability is Fail, not Not Applicable. Evidence collection, evaluation, Gate authorization, and record completion are separate activities under Specification Section 3.2.6; no later completion reference creates an earlier circular prerequisite.
| Testable | The required evidence can be inspected and compared against the Requirement, Pass condition, Fail condition, decision scope, authority, rule, threshold, version, or Gate readiness state. |
|---|---|
| Implementable | A real team can satisfy the control through a manual procedure, workflow, governed record, rule engine, metadata repository, catalog, semantic layer, data-quality process, identity process, stewardship process, API, automation, or hybrid mechanism. |
| Executable | The control has a repeatable evaluation path, recorded evidence, an accountable authority, an approved rule reference where applicable, and the required control result and Gate readiness state where applicable. Executable does not require software code. |
Do not use executable to imply that AI output is inherently deterministic, that a prompt is sufficient as a control, or that a model can establish its own DACS conformance.
Preferred operating statement
DACS controls may be executed manually, procedurally, automatically, or through hybrid workflows. The requirement is not the implementation mechanism. The requirement is testable evidence, a recorded control result, and a Gate readiness state for the stated decision scope.
Authority and execution in the control cards. Every card identifies the accountable authority for the control. Execution guidance appears only when timing, repeatability, enforcement, sequencing, or evidence capture is material to the control. If no Execution entry appears, the universal execution rule above applies. Generic tool lists are intentionally not repeated in every card.