Incident Governance Policy:
- Incident Commander has final authority.
- External communication requires executive approval.
- Overrides must be documented and time-bound.
