> Documentation version: 3. [HTML page](risks-and-controls.html)

<a id="risk-and-control-reference"></a>

# Risk and control reference

Follow these links for each risk’s controls, verification and residual
assumptions. Each chapter owns its guidance; this index adds no requirements.

<a id="find-the-relevant-explanation"></a>

## Find the relevant explanation

- **Executed code crosses into publication authority**: [Execution boundaries](security-model.md#risk-execution-authority), [Action wrappers](actions.md#risk-action-boundaries) and [effective settings](settings.md#risk-settings-enforcement).


- **Storage or an upgrade substitutes executable bytes**: [Artifact admission](artifact-verification.md#risk-artifact-admission), [provisioning](pure-package.md#risk-utility-provisioning), [tool selection](environment.md#risk-tooling-selection) and [upgrades](maintenance.md#risk-input-upgrades).


- **Tested source or assets differ from the delivered release**: [Release evidence](workflows.md#risk-release-evidence), [example archives](examples.md#risk-example-identity) and [native-input publication](linker-input-releases.md#risk-linker-publication).


- **Source roles or native targets are confused**: [Source boundaries](repository.md#risk-source-boundaries) and [native targets](platforms.md#risk-native-targets).


- **Partial, stale or unrelated results appear successful**: [Compatibility verdicts](nightly-compatibility.md#risk-compatibility-verdicts) and [adoption](adopting.md#risk-adoption-evidence).


- **A test hangs, hides diagnostics or substitutes smoke for deeper testing**: [Test evidence](testing.md#risk-test-evidence) and [campaign separation](optional-workflows.md#risk-campaign-separation).


- **Utility copies, companions or interfaces drift**: [Utility contracts](shared-utilities.md#risk-utility-contracts) and [policy evidence](policy.md#risk-policy-evidence).


- **Composition records omit components or bind the wrong artifact**: [Component evidence](software-bill-of-materials.md#risk-component-evidence).


- **Documentation or an assessment overstates the checks**: [Documentation claims](documentation.md#risk-documentation-claims), [retrievable formats](documentation.md#publish-static-markdown), [diagram rendering](roc-docs.md#images-and-diagrams) and [maintaining explanations](contributing.md#explain-the-risk-and-control-where-they-apply).