c16 — Seat-Centric Framing Review (wf2)

Question: for each page, how well does it speak to the seat that owns it — and how could we be clearer about that seat's concerns, surface the most important info/actions, and add derived signal (abstractions/simplifications) the raw data doesn't yet express?

Method: read every wf2 page's current framing + structure + the fields it uses vs. the fields available in app/data/c16-fleet.ts. Recommendations are clarity (frame the seat's job), surface (lead with what matters + the action), derive (compute new signal).

Cross-cutting findings

1. Shared pages still wear one framing (the G1 gap, narrowed not closed). Six pages serve more than one seat — fleet-overview, agent-inventory, findings, security-posture, data-protection, cost-center, policy-enforcement — but each renders one fixed lead regardless of the seat you entered from. The seat landings now articulate value well; the shared deep pages don't yet re-lens. The cheapest high-impact move is a per-seat lens: the WirePagePurpose takeaway/actions (and the default sort / one "lead" column) switch on ?seat.

2. The same structural gap recurs on almost every page: we show one dimension when the decision needs two combined. Inventory shows posture or cost; findings show severity but not whether the agent is governed; cost shows spend but not risk; posture shows the score but not the cheapest way to raise it. The fix is a small set of compound/derived signals (below) reused across pages.

3. We measure state, not motion or leverage. first_seen, worst_score, and costs.series are present but underused: we rarely show how long a shadow agent has been unseen, whether an agent improved, where the trend is heading, or which single fix moves the number most. These are the abstractions that turn a dashboard into a recommendation.

Build-once abstractions (compute once, reuse across pages)

These are derivable from existing c16-fleet.ts fields and pay off on multiple seats:

Per-page recommendations

Security · CISO

security-home (seat landing) — already strong (governance-first, "what needs a human").

• Surface: split the lead into two cards that match the CISO's two questions — Control Coverage % (am I blind to anything?) and Critical-&-ungoverned count (what's dangerous and unaccountable?). Today "ungoverned" and "shadow" are separate; the scariest number is their union over total.
• Derive: a single fleet trajectory line ("posture 76, +X this week → 80 in ~N weeks").

agent-inventory (Security; also Engineering) — title/sort now risk-first (good).

• Clarity: keep the "gaps" framing for Security; for Engineering (?seat=engineering) re-lens to "what's running, what's costly, what's slow" (default-sort cost or p95, lead with utilization not governance).
• Surface: add a compound-risk badge on rows that are Critical and ungoverned (today the two facts sit in different columns); add a risk-factor mini-cell (factors[0]) so a CISO can scan drivers without opening each profile.
• Derive: shadow age column ("unseen 4d") and a per-vendor governance-gap rollup ("OpenAI: 2 of 3 ungoverned").

agent-profile (Security; Eng secondary) — now opens with a risk summary (good).

• Surface: a "why this score" line that names the top deductions with points (factors × FACTOR_PTS) and the delta vs worst_score ("was Critical 50 → now 65, improving"). worst_factors/worst_score are loaded but unused.
• Derive: a data-risk sub-score = Σ(sensitive_files.severity × opens) and an MCP footprint (servers × calls) so "what can this agent reach" is one glance.

findings (Security; also Compliance, Eng) — leads with the most-urgent finding (good).

• Surface: tag each finding row with the offending agent's governed? state — a CISO can't enforce remediation outside the governance boundary, so ungoverned-agent findings should visibly jump the queue.
• Derive: score-impact per finding ("fixing 'running as root' = +25") to rank by remediation ROI, not just severity; findings-per-agent rank so repeat offenders surface.
• Compliance lens (?seat=compliance): group by framework first, not severity.

security-posture (Security; Exec/Compliance read) — the model page; board recommendation now up top.

• Surface: turn "what lowers the score" into a fix-this-first roadmap ranked by Hardening-ROI (count × points): "fix --yolo on 1 agent = +35 (most leverage)."
• Derive: an effective-posture worst-case ("if the 1 shadow agent is Critical, fleet drops to X") to price the instrumentation gap; a posture trend sparkline (projected).

agent-identity (Security; Compliance secondary) — NHI framing + action-per-tier (good).

• Surface: a compound badge for cred_risk==='High' on a Critical/ungoverned agent (worst-of-both); show last-used (last_api_call) so inactive creds are "safe to rotate now."
• Derive: credential age proxy from first_seen (flag static keys > 90d), and org-binding coverage % ("84% org-backed OAuth, 16% static/alias") as a one-line compliance stat.

data-protection (Compliance primary; Security co-owner) — see Compliance section.

policy-enforcement (Engineering primary; Security/Exec read) — see Engineering section.

Finance · FinOps

finance-home (seat landing) — Finance-centric, flags the chargeback blocker (good).

• Surface: add the missing FinOps question — "are we on track?": a forecast-vs-budget tile and a runway ("at this run-rate, budget in N weeks"). Today the forecast lives only on cost-center.
• Derive: provider-concentration ("72% Anthropic") and cache savings this period.

cost-center (Finance; Exec read) — now has budget-vs-actual + forecast (good).

• Surface (the #1 Finance gap): governance-tag the spend — mark each by-agent row as governed/ungoverned and risk tier, and add a "$X of spend is ungoverned/at-risk" callout. Finance needs to see when high spend is also a control problem, not just a number.
• Derive: cost-per-session and $/token by model (which model is cheapest per unit → a runtime-selection lever); cost anomaly flag (agent's share jumped vs costs.series).

showback (Finance; Compliance/Exec read) — leads with top exposure + chargeback blocker (good).

• Surface: add a risk-adjusted view — a person with $200 at Critical risk should outrank a $5k "ok" spender for attention (you already rank risk-then-spend; make the liability $ explicit: "$X of spend has no chargeable owner").
• Derive: chargeback-readiness % per identity (verified-org share of their spend) and a Team/Dept rollup stub (projected) so spend ladders to a cost center.

Executive

executive-home (seat landing) — board-grade scorecard (good).

• Surface: add trajectory ("on track to 80 in ~N weeks") and a governance breakdown (Critical/Elevated/Standard counts) so the exec sees distribution, not just an average.
• Derive: shadow-AI financial exposure ("$X flows through agents we can't see").

executive-board (Executive) — the strongest page; trend narrative + target line landed.

• Surface: state the governance-vs-spend story explicitly ("posture up while spend rose — control is improving despite growth") — the one sentence a board remembers.
• Derive: at-risk-spend concentration ("top 3 agents = 80% of at-risk $") and findings backlog trend (are we closing faster than we open?). Add a benchmark caption for the index (what "80" means) so the number has a frame.

fleet-overview (shared; default Exec, also Finance/Security) — the "everyone starts here" page.

• Clarity: this is the one page that should be explicitly seat-lensed — the attention strip and the lead KPI should reorder by seat (Finance → spend/forecast first; Security → findings/critical first; Exec → governance index first).
• Surface: add governed? to the roster table (it's on exec-board but not here) and a cost-per-posture-tier row ("critical agents also cost $X").
• Derive: fleet motion — agents new this week / newly Critical / newly Hardened — so the shared picture shows change, not just a snapshot.

Engineering · Platform

engineering-home (seat landing) — leads with p95/ungoverned/shadow/MCP (good ops triage).

• Surface: rank "what to fix next" — a worst-agent line combining p95 + cost + governed state (one prioritized target), not four separate counts.
• Derive: instrumentation coverage % (the Eng twin of Control Coverage) and high-latency × high-cost agents (runaway consumers).

performance (Engineering) — clean latency isolation; latency≠outcome gap now in the lead.

• Surface: add the cost angle the slowest agents almost certainly carry — a $/call column next to p95 (slow and expensive is the real target).
• Derive: latency-by-model (model-choice trade-off), variance (p99−p50)/avg (erratic agents), and keep Task Outcomes as the named, projected next dimension.

policy-enforcement (Engineering; Security/Exec read) — behavior-first dry-run + blast radius (good).

• Surface: make it per-agent actionable — which specific agents would be hit by each policy (the dry run is fleet-aggregate; Eng needs the target list to act).
• Derive: approval-policy coverage % (track toward 100), tool-call diversity per agent (mcp_servers count → who needs an allow-list most), and "cost of flipping to Enforce" (how many runs/agents would be blocked) so autonomy reduction is quantified.

integrations (Engineering) — live-vs-projected honest; connectors ranked (good).

• Surface: a per-connector payload estimate (events/findings each would carry) so a rollout can be sized; flag that exporting shadow agents leaks blind spots.
• Derive: coverage gap per sink (which agents would export as gaps) — relevant to both Eng and Compliance.

Compliance · Privacy

compliance-home (seat landing) — framework-first, honest "evidence not checkmark" (good).

• Surface: add conformance coverage — frameworks-with-evidence vs. tracked, and flag zero-finding frameworks (false confidence is the compliance officer's real fear).
• Derive: high-findings-by-agent accountability and evidence completeness % (instrumented share × agents-with-findings).

compliance (Compliance) — excellent taxonomy + audit why-trail.

• Clarity: add one line explaining the inference model — a high finding reveals a control gap, it isn't itself a "failed control" (auditors need that distinction).
• Surface: within each framework, tag findings from ungoverned agents (control interpretation differs) and show evidence recency (earliest/latest).
• Derive: audit-readiness per framework (depth/breadth of findings) and evidence-gap (frameworks whose only evidence comes from shadow agents = blind spots).

data-protection (Compliance primary; Security co-owner) — data-movement focus, content-gap honest (good).

• Surface: a per-agent / per-owner exposure drill-down (who touched which high-severity paths) — today it's category/owner aggregates; incident response needs the agent.
• Derive: high-severity exposure by agent rank, read/write asymmetry (writes ≫ reads = data leaving), sensitive-file recency (active vs. historical), and DLP instrumentation coverage (shadow agents = unmeasured data access).
• Security lens (?seat=security): lead with the credential/secret paths and the agents touching them, not the privacy/owner rollup.

Recommended next steps (priority order)

1. Per-seat lens on the 6 shared pages — switch WirePagePurpose takeaway/actions + the one "lead" element on ?seat (cheap, closes the last of G1). Start with fleet-overview.
2. Ship the build-once abstractions as small helpers in c16-fleet.ts (Control Coverage %, compound-risk flag, Hardening-ROI, governance-tagged spend, trajectory) and reuse.
3. Two structural adds with the highest cross-seat payoff: governance-tag the spend (Finance/Exec) and the compound risk flag (Security/Exec) — both turn "two numbers" into "one decision."
4. Fold the rest in per page as the wireframes mature or as they graduate to hi-fi.