SGAF leans on published reference data. The risk is not that the data is wrong at source; it is that a stale or failed import quietly becomes what the product shows a governor.
The pipeline checks source versions and file hashes, validates each candidate release before it is promoted, retains the last good release so a bad one can be refused, and writes a freshness receipt for every run. Operational cards tell the agent system what changed or needs attention, and stay silent when nothing did.
Recorded runs include successful publication and correct detection of no change, which is the harder case to get right.