Govern · control tower
Autonomy is a contract, not a permission
Every agent in the estate carries a ceiling, a confidence floor and a named escalation path. This page is the single record of what those limits are, who owns them, and what happened when they were reached.
Health
Where the estate stops for approval
Gates by kind across the functions, and the governance events they have generated.
Active gates
0
published thresholds
Non-waivable
0
no one can override
Kill switches
0
armed and tested
Awaiting decision
0
sitting with a human
Gate coverage by function
Red bars are gates that cannot be waived by any persona, at any materiality.
Kill switches
Conditions that suspend agent authority automatically.
- Incorrect customer identity resolution
- Fabricated evidence in a customer-facing brief
- Opt-out or consent breach detected
- Abnormal outbound message volume
- Unapproved commercial representation
- Consent or preference enforcement failure
- Harmful or prohibited content detected
- Abnormal complaint or unsubscribe rate
- Broken attribution or measurement integrity loss
- Uncontrolled spend pace against guardrail
- Unauthorized price change detected
- Mass rerouting event
- Forecast instability beyond tolerance band
- System-of-record mismatch on revenue data
- Commission calculation variance above threshold
- Invented or unverifiable authority cited
- Lost provenance on a material document
- Cross-matter data leakage
- Privilege exposure risk detected
- Unauthorized external filing attempt
- Sanctions or denied-party alert
- Supplier bank-detail anomaly
- Collusion or bid-rigging signal
- Duplicate-payment pattern detected
- Off-contract spend surge beyond tolerance
- Sensor or telemetry inconsistency
- Unstable repeated replanning (bullwhip signature)
- Unusual order amplification across nodes
- Safety-critical material movement without clearance
- Plan divergence from system of record
- Unexplained dependency introduced into the build
- Secret or credential exposure detected in a diff
- Test bypass or coverage suppression
- Architecture-policy violation in a merged change
- Rising incident rate after an agent-prepared release
- Unlicensed or improperly sourced data in a study
- Irreproducible output promoted as a result
- Fabricated or unresolvable citation
- Unsafe protocol proposed or scheduled
- Leakage of unpublished invention material
- Ledger imbalance detected after an agent posting
- Duplicate payment pattern identified
- Segregation-of-duties breach in an agent action chain
- Unexplained journal pattern outside policy
- Missing source evidence for a posted entry
- Protected-characteristic inference detected in any model output
- Unexplained outcome disparity across a candidate or employee cohort
- Confidential employee data exposed outside its access boundary
- Inability to provide a human appeal path
- Agent action taken on a consequential employment decision
- Credential abuse or impossible-travel authentication
- Lateral movement pattern across segments
- Abnormal command sequence issued by an agent
- Monitoring blindness or telemetry gap
- Failed rollback during an agent-prepared change
- Exposure of executive location or itinerary
- Unauthorized visitor granted site access
- Repeated booking error affecting an executive
- Records-policy violation or premature deletion
- Sensitive meeting content routed outside its audience
- Identity verification failure in a served interaction
- Harmful or unsafe advice detected in an agent response
- Repeated unresolved loop without human offer
- Sentiment escalation without a routing to a person
- Abnormal remedy or refund volume in a short window
- Widespread control failure across a service line
- Queue duplication producing double execution
- Cross-entity or cross-client data leakage
- Inability to attribute an action to an accountable agent or human
- Autonomy increase applied without business-owner approval
Escalation matrix
What stops the agent, who it goes to, and how long they have.
| Function | Gate | Threshold | Approver | SLA | Waivable |
|---|---|---|---|---|---|
| Sales | approvalMass campaign above 500 recipients | Any bounded outreach exceeding 500 recipients in a rolling 24 hours | Sales leader | 4 business hours | Never |
| Sales | approvalNonstandard commercial statement | Any language outside the approved commercial library | Deal desk | 1 business day | Never |
| Sales | escalationProtected or executive account contact | Outreach to named strategic, executive or legally protected accounts | Account executive | 2 business hours | Never |
| Sales | oversightEvidence provenance audit | Weekly sample of 5% of agent-produced customer briefs | Sales operations | Weekly | With reason |
| Marketing | approvalNew or regulated claim | Any performance, comparative or regulated product claim not already substantiated | CMO and General Counsel | 2 business days | Never |
| Marketing | approvalBudget reallocation guardrail | Reallocation above 5% of campaign budget or $100,000 | CMO | 1 business day | Never |
| Marketing | approvalNew personal-data use | Any new data class, inferred attribute or third-party audience source | Privacy officer | 3 business days | Never |
| Marketing | escalationCrisis or socially sensitive content | Public position, crisis response or politically sensitive topic | CMO and Communications | 2 hours | Never |
| RevOps | approvalQuote above $250,000 | Any quote exceeding $250,000 total contract value | Deal desk | 4 business hours | Never |
| RevOps | approvalMargin below floor | Any configuration priced beneath the published margin floor | Deal desk and Finance | 1 business day | Never |
| RevOps | approvalTerritory change affecting 10+ sellers | Coverage change touching more than 10 quota-carrying sellers | SVP Revenue Operations | 3 business days | Never |
| RevOps | escalationCommission variance above 2% | Calculated payout deviating more than 2% from modeled expectation | Finance controller | 2 business days | Never |
| Legal | approvalAny external legal communication | Every communication leaving the enterprise on a legal matter | Named lawyer | Same day | Never |
| Legal | approvalContract above $250,000 | Contract value above $250,000 or nonstandard indemnity, unlimited liability or IP transfer | General Counsel delegate | 2 business days | Never |
| Legal | approvalSettlement or regulator filing | Any settlement, filing or regulator submission | General Counsel | Case dependent | Never |
| Legal | oversightCitation and provenance audit | Every agent-produced document with external authority citations | Citation Verifier plus lawyer sign-off | Pre-release | Never |
| Procurement | approvalPurchase order above $25,000 | Any PO above $25,000 or off approved catalog or unbudgeted | Category manager | 1 business day | Never |
| Procurement | approvalNew supplier or bank-detail change | Supplier onboarding or any change to payment banking details | Procurement controller | 2 business days | Never |
| Procurement | approvalPayment above $100,000 | Payment release above $100,000 | Finance controller | Payment run | Never |
| Procurement | escalationSingle-source award or critical negotiation | Single-source exception or any negotiation affecting critical supply | Chief Procurement Officer | 3 business days | Never |
| Supply Chain | approvalWeekly plan change above 10% | Replanning that shifts more than 10% of a weekly production or replenishment plan | Planning lead | 4 hours | Never |
| Supply Chain | approvalPremium freight above $50,000 | Any expedite decision above $50,000 | Logistics director | 2 hours | Never |
| Supply Chain | approvalCustomer allocation decision | Any allocation that reduces a committed customer quantity | CSCO with Sales | Same day | Never |
| Supply Chain | oversightPlan-stability monitor | Continuous check for order amplification and repeated replanning signatures | Supply Chain Chief of Staff | Continuous | Never |
| Engineering | approvalProduction release authorization | Any deployment to a production environment | Release manager and service owner | 1 business day | Never |
| Engineering | approvalSecurity-sensitive or public API change | Authentication, cryptography, payment paths or any published interface contract | Senior engineer and security engineer | 1 business day | Never |
| Engineering | approvalDatabase migration | Any schema change or irreversible data operation | Data owner and CTO delegate | 2 business days | Never |
| Engineering | oversightAgent-authored code sample review | Weekly review of 10% of agent-authored merged changes | Engineering governance | Weekly | With reason |
| R&D | approvalPhysical experiment authorization | Any laboratory experiment involving materials, equipment or subjects | Principal investigator and safety officer | 2 business days | Never |
| R&D | approvalExternal data acquisition | Any new external dataset, license or third-party evidence source | Research governance and Legal | 3 business days | Never |
| R&D | approvalPublication or external disclosure | Any material leaving the research boundary, including conference abstracts | CSO and General Counsel | 5 business days | Never |
| R&D | oversightReproduction sampling | Independent re-derivation of 15% of reported internal results | Reproducibility board | Monthly | Never |
| Finance | approvalPayment above $100,000 | Any single payment or batch exceeding $100,000 | Controller and treasurer | 4 business hours | Never |
| Finance | approvalNonstandard journal entry | Any entry outside the approved recurring library, including estimates and reserves | Controller | 1 business day | Never |
| Finance | approvalNew or changed bank details | Any change to supplier or employee banking information | Treasury and supplier master owner | 2 business days | Never |
| Finance | approvalExternal disclosure or board forecast | Any external report, statutory filing or board-committed forecast | CFO | 3 business days | Never |
| HR | approvalCandidate rejection on substantive assessment | Any rejection based on capability judgment rather than administrative criteria | Hiring manager | 2 business days | Never |
| HR | approvalOffer terms and compensation | Any offer, compensation change or exception to the published band | HR business partner and compensation lead | 2 business days | Never |
| HR | approvalPerformance or disciplinary action | Any rating, performance plan, disciplinary step or termination | Manager and HR business partner | 3 business days | Never |
| HR | oversightAdverse-impact testing | Monthly outcome testing across all agent-supported selection processes | CHRO and employment counsel | Monthly | Never |
| IT | approvalPrivileged access grant | Any administrative, root or elevated entitlement | Identity governance and system owner | 4 business hours | Never |
| IT | approvalFirewall or network boundary change | Any rule affecting segmentation, ingress or egress | Network security lead | 1 business day | Never |
| IT | approvalProduction database or destructive action | Any data-affecting operation in production, including bulk deletion | Data owner and CIO delegate | 1 business day | Never |
| IT | escalationMajor incident command | Any severity-one incident or suspected compromise | Incident commander | 15 minutes | Never |
| Admin | approvalTravel above $5,000 | Any itinerary exceeding $5,000 in total cost | Function leader | 1 business day | Never |
| Admin | approvalSecurity-sensitive itinerary | Travel to any listed destination or any executive protection requirement | Security and Chief Administrative Officer | 2 business days | Never |
| Admin | approvalRecords disposition | Any deletion, destruction or retention-period change | Records officer and Legal | 5 business days | Never |
| Admin | escalationExecutive calendar displacement | Any change that displaces an existing external commitment | Executive assistant | 2 hours | Never |
| Cust Svc | approvalRefund or remedy above $500 | Any single remedy exceeding $500 in customer value | Service manager | 4 business hours | Never |
| Cust Svc | escalationVulnerability or hardship indicator | Any signal of hardship, bereavement, distress or safety risk | Trained human specialist | Immediate | Never |
| Cust Svc | escalationLegal complaint or regulatory reference | Any legal threat, regulator mention or formal complaint | Legal and service leadership | 2 hours | Never |
| Cust Svc | approvalDeparture from published remedy | Any resolution outside the published remedy catalog | Service manager | 1 business day | Never |
| AI GBS | approvalAutonomy level increase | Any move of an agent or workflow to a higher autonomy band | Business owner and risk | 5 business days | Never |
| AI GBS | approvalNew data class processing | Any service processing a data class not already approved | Risk and privacy officer | 5 business days | Never |
| AI GBS | approvalOutsourcing or service removal | Any material operating-model, sourcing or service-portfolio change | GBS executive committee | 10 business days | Never |
| AI GBS | oversightAgent recertification | Quarterly evaluation of every agent against its published certification criteria | Agent governance board | Quarterly | Never |
Decision ledger
Every recorded outcome across the estate. Enterprise override rate is running at 7.1%.
RFx comparison pack — logistics tender — decided from the Enterprise Chief of Staff lens on the ops floor.
Avery Chen (Enterprise Chief of Staff) · Procurement · materiality medium
Renewal risk pack — Northwind Logistics — decided from the Enterprise Chief of Staff lens on the ops floor.
Avery Chen (Enterprise Chief of Staff) · Sales · materiality medium
Proposal Agent assembled a 22% discount scenario; published autonomous band is 15%. Package paused with evidence and margin impact attached.
Deal Desk Chief of Staff · Sales · materiality high
Vulnerability Agent detected bereavement language, stopped all automation on the case and warm-transferred the customer to a trained specialist with context preserved.
Vulnerability Agent · Cust Svc · materiality high
Cyber Triage Agent detected authentication from two continents within nine minutes, suspended the session, forced re-authentication and escalated to security operations with a full indicator pack.
Cyber Triage Agent · IT · materiality high
AP Agent identified three invoices matching an already-settled reference across two entities. Payment run paused and the exposure of $284,000 packaged for the Controller.
AP Agent · Finance · materiality high
Supplier Risk Agent detected a bank-detail change request originating from an unverified domain for a tier-1 supplier. Payment run frozen for that vendor pending callback verification.
Supplier Risk Agent · Procurement · materiality high
Pricing Agent blocked a configuration 4.2 points beneath the margin floor and packaged the margin bridge for deal-desk and Finance review.
Deal desk · RevOps · materiality high
Patch Agent scored an actively exploited vulnerability against 46 exposed assets and prepared an out-of-cycle change with tested rollback.
Change board · IT · materiality high
SLA Agent reprioritized 284 cases across six service lines, preventing predicted tier-one breaches without additional human capacity.
SLA Agent · AI GBS · materiality low
Citation Verifier could not resolve two cited authorities in a draft position memo. Document blocked before circulation and the drafting chain was flagged for review.
Citation Verifier · Legal · materiality high
Control-Tower Communicator issued factual revised ETAs using approved templates. No commitment or goodwill language included.
Control-Tower Communicator · Supply Chain · materiality low
Release Agent assembled the deployment plan, rollback rehearsal evidence and test attestation for the payments service. Two moderate findings remain open and are documented in the pack.
Release manager · Engineering · materiality high
CRM Steward merged 212 duplicate account records under the published data contract and preserved the full merge lineage.
CRM Steward · RevOps · materiality low
Content Supply Agent produced 12 asset variants containing an unsubstantiated comparative claim. Brand Guardian blocked activation and packaged the substantiation gap for Legal.
Brand Guardian · Marketing · materiality high
Travel Agent rebooked 14 travelers affected by a hub cancellation within policy, notified each traveler and preserved original cost centers.
Travel Agent · Admin · materiality low
Data Steward found a third-party dataset without an enterprise license inside an active catalysis study. Analysis halted and the dependency graph published for research governance.
Data Steward · R&D · materiality high
Journey Operator handed a high-intent account to Qualification Agent with consent state, engagement history and attribution evidence intact.
Sales Chief of Staff · Sales · materiality low
Resolution Agent assembled a $1,240 remedy for a repeated fulfillment failure. Held for service-manager decision with cost-to-serve and relationship history attached.
Service manager · Cust Svc · materiality medium
31 accounts crossed the intent threshold with consent and attribution evidence attached. Handoff accepted by the Sales Qualification Agent.
Marketing Chief of Staff · Marketing · materiality low
Fairness Monitor blocked a sourcing filter using continuous-employment history, which correlated with a protected characteristic in the candidate pool. Criterion removed and the search rerun.
Fairness Monitor · HR · materiality high
Disruption Agent modeled three recovery paths for a 72-hour port closure affecting 41 shipments. Cost and service impact quantified for CSCO decision.
Chief Supply Chain Officer · Supply Chain · materiality high
Reconciliation Agent cleared 3,412 balance differences beneath the published materiality threshold with full supporting evidence retained.
Reconciliation Agent · Finance · materiality low
A temporary database administrator entitlement was requested for a migration window. Identity Agent assembled justification, duration and monitoring plan for identity governance.
Identity governance · IT · materiality high
Case Router detected the same intake creating two work items across Procurement and Finance. Duplicate suppressed before execution and the routing rule corrected.
Case Router · AI GBS · materiality medium
Security Agent detected a live credential in a feature branch, blocked promotion, revoked the token through the identity service and opened an incident record.
Security Agent · Engineering · materiality high
Forecast Agent widened the range after three enterprise deals lost next-step evidence. Assumption log published with the exception list.
Forecast Agent · RevOps · materiality medium
Consent register showed opt-out for 34 contacts inside an approved sequence. Engagement Agent suppressed automatically and logged evidence.
Engagement Agent · Sales · materiality low
Travel Agent assembled an itinerary to a listed destination. Booking held pending security review; alternative routings and risk notes are attached.
Corporate security · Admin · materiality high
Offboarding Agent detected two active application accounts 26 hours after a departure. Access revoked through IT identity and an evidence record opened.
Offboarding Agent · HR · materiality medium
Consent Agent detected 2,140 contacts with a channel preference conflict inside an active lifecycle journey. Journey paused, contacts suppressed, evidence logged.
Consent Agent · Marketing · materiality medium
Proactive Service Agent correlated 214 contacts to one firmware release and packaged the evidence for Engineering, Legal disclosure review and Communications.
Customer Service Chief of Staff · Cust Svc · materiality high
Negotiation Agent concluded 38 tail-spend agreements within mandate. Average saving 3.1%, average term extension 12 days.
Negotiation Agent · Procurement · materiality low
Incident Agent applied an approved runbook to 214 endpoints affected by a certificate expiry, restoring service without human handling.
Incident Agent · IT · materiality low
Playbook Reviewer identified an uncapped indemnity request on the Aurora master agreement and packaged three fallback positions with precedent evidence.
General Counsel delegate · Legal · materiality high
Experiment Designer proposed a temperature-cycling protocol outside the previously validated range. Held for principal investigator and safety officer authorization.
Safety officer · R&D · materiality high
Expense Agent identified nine claims matching prior submissions across two cost centers and routed the pattern to the Finance controls desk.
Expense Agent · Admin · materiality medium
Developer Agent applied 23 low-risk dependency updates with full regression passes and provenance recorded against each change.
Developer Agent · Engineering · materiality low
Plan-stability monitor detected four replans of the same node within six hours. Autonomous replenishment paused for that node pending planner review.
Supply Chain Chief of Staff · Supply Chain · materiality medium
FP&A Agent modeled a warranty reserve movement driven by claim-rate change. Held for accounting-policy judgment; the model, assumptions and sensitivity are attached.
Controller · Finance · materiality high
Actions
What is waiting on a person
A gate that never fires and a gate that always waives look identical on a dashboard. These are the ones worth a person reading.
Read a high-materiality decision
The largest calls on the record, with the actor who made each one.
Confirm an escalation reached a named person
Escalation events recorded against a gate.
Decide whether a waivable gate should stay waivable
A gate somebody is allowed to skip is a gate that will be skipped.
Explain a function with gates but no events
Gates are defined and nothing has passed through them on the record.
Operations
What this desk is allowed to start
A surface that only reports is not operable. This is the work this page can set in motion, and the bound it runs into.
Trigger and bound
This desk can open a gate decision, record an approval or a refusal against it, and route an escalation to the named approver with its service-level clock running. It cannot invent a gate at run time: an act that matches no gate proceeds unreviewed, which is why a function with gates and no events is shown above as a question rather than as a clean result.
Live observability
What the record shows right now
What has actually passed through governance, by kind.
Current distribution
58 events
Is policy and strategy coming to fruition
Whether the written intent is holding here
56 gates defined, 58 decisions recorded against them, 8 of the gates exist purely to escalate.
Nothing on the record settles this
The intent is that a decision above a threshold reaches a named human before it commits. The record shows the mechanism exists and is used, but it cannot tell you whether it is used every time it should be: the platform records the decisions that went through a gate, not the acts that should have hit one and did not. Until an act that bypasses a gate is itself detectable, this page proves gates are in service, not that they are complete.