I would add security and governance review before the scoring layer and ensure that scoring layer should include those feedbacks into next todos.