A utility proposes dynamic scoping so newly discovered critical applications automatically enter GRC scope. Which capability does that approach rely on?

Dynamic scoping relies on entity-type conditions that continuously select qualifying records so scope stays current as the CMDB changes. When a utility wants newly discovered critical applications to enter GRC scope automatically, the pattern is conditions on criticality or similar durable attributes plus generation/refresh—not heroic manual adds. That automatic sprinkler keeps civic GRC aligned with discovery without hardcoding sys_ids. Manually cloning each new application entity from a spreadsheet every quarter cannot keep pace with discovery-driven growth. Deleting entity types whenever the CMDB discovery schedule runs destroys the selector instead of refreshing entities. Replacing the entity framework with a single hardcoded list of sys_ids in a UI policy creates brittle, unmaintainable scope. Exam caveat: entity-type conditions plus generation/refresh are the dynamic scoping mechanism. Operational check for the utility: encode “business criticality is high” (or equivalent) on an application entity type, run discovery to add a new critical app CI in subprod, execute generation/refresh, and confirm a new entity appears without a spreadsheet import. In civic IRM programs, document the decision, name owners, and verify the platform records match the intended operating model before expanding scope. Re-check after organizational or CMDB changes so evidence remains defensible.