Clay Governance Framework
Six governance domains with minimum standards, an ownership matrix and maturity levels — the operating model behind governed Clay.
Governance fails when it is a policy document nobody applies. This framework is built as an operating model: each domain has a minimum standard you can enforce this month, an owner who is accountable, and a maturity level that tells you where you stand.
| Domain | Minimum standard (enforce this first) | Owner | Review cadence |
|---|---|---|---|
| Workspace | Named admins with backup; builder access separated from production; quarterly access review | Workspace admin | Quarterly |
| Data | Canonical field map with per-attribute source of truth; validation before any CRM write | Data / RevOps | Quarterly |
| Cost | Provider hierarchy documented; per-workflow credit budgets; monthly spend review | RevOps | Monthly |
| Workflow | Named owner per production workflow; documentation standard; review-before-deploy | GTM Engineering | Monthly |
| Integration | Scoped, inventoried, rotated API keys; documented CRM write scopes and webhook behavior | IT / Security | Quarterly |
| Operational | Monitoring with named on-call; documented incident first-steps; failure postmortems for CRM-affecting faults | Ops | Per incident |
Ownership matrix (template)
| Domain | Accountable | Consulted | Informed |
|---|---|---|---|
| Workspace | Workspace admin | GTM Engineering | All users |
| Data | Data / RevOps lead | GTM Engineering, IT | Sales & Marketing leadership |
| Cost | RevOps lead | Finance | Budget owners |
| Workflow | GTM Engineering lead | Workflow owners | Downstream system owners |
| Integration | IT / Security | GTM Engineering | CRM admin |
| Operational | Ops lead | On-call rotation | Leadership |
Maturity model
Level 1 — Ad-hoc
Workflows built by individuals; documentation optional; permissions accumulate; costs visible only on the invoice.
Level 2 — Defined
Naming, ownership and source-of-truth rules exist and are mostly followed; environment separation partial; costs tracked but not attributed.
Level 3 — Managed
Change management, monitoring and cost controls operate across all six domains; reviews happen on cadence; incidents have owners.
Level 4 — Optimized
Standards are inherited by new use cases by default; governance checks are automated where possible; audits are routine and cheap.
Assessment rule of thumb: your maturity level is the lowest domain, not the average. Most enterprise deployments we assess sit at Level 1–2, with cost and integration governance furthest behind.