c16 · wf5 — Report & Seat-Needs Analysis

A standalone report on the wf5 "persona-first synthesis" control plane: how it's structured, the strategy behind that structure, and an honest assessment of how well it serves each core seat — with prioritized areas to improve.

Route: /c16/wireframes/wf5/control-plane-v1/security-home Companion docs: wf5-analysis.md (the build rationale), analysis.md (Phase-1 scoring), seat-composition-review.md (the gap backlog), cycle-history.md (the question model).

Part 1 — Structure & Strategy

1.1 The core bet

wf5 is built on one decision: the user's role is the primary axis of the app, not the feature. The app is partitioned into five persona seats — Security · CISO, Finance · FinOps, Executive, Engineering · Platform, Compliance · Privacy. You enter as a who, and everything you see is already framed for that who. The unit of analysis underneath is the agent as an actor (what it is, does, costs, who owns it, how safe it is) — never network egress, which is demoted to a single detail card on the agent profile.

wf5 is the synthesis of two prior passes: it keeps wf3's clean persona structure and per-seat lensing, carries wf4's richer surfaces (Effectiveness, Usage Limits, Teams & Users, wall mode, lifecycle states, evidence pack), and demotes wf4's explicit four-question navigation to an implicit ordering rule. It then adds the one first-class question nobody had built: Activity — "what happened?"

1.2 Four structural mechanisms

(a) Persona-first navigation. FleetSeatNav5 lists five seats; the active seat expands to a flat list of its pages. No feature mega-menu, no question-group headers. The nav answers exactly one thing — "who am I" — and gets out of the way.

(b) Per-seat lensing (?seat). The deep pages are shared, but each re-leads by seat. The same Fleet Overview shows Finance spend-at-risk first, Security control-coverage first, Executive the governance index, Engineering instrumentation/latency, Compliance framework conformance. This is the core efficiency of the app: one fleet, one data model, five different first questions — not five duplicated apps. Duplication across seats becomes a feature (the right lead per role), not debt.

(c) The implicit lifecycle arc. The four questions (Assurance → Effectiveness → Security → Identity & Access → Admin) survive only as the order of pages within a seat — alive → working → safe → accountable → traced → wired. The escalation still shapes the experience; it's just no longer furniture you have to read. (This was the explicit ask: less explicit than wf4, which made the questions a visible second navigation plus an Orientation tutorial page.)

(d) The value-first page contract. Every page opens with WirePagePurpose: a purpose (why the page exists / what question it answers), a computed bottom line (the "so what" for this fleet right now), and a recommended next action. A page articulates value before it renders a table.

1.3 Two cross-cutting design laws

• Honesty — known vs guessed. est cost badges, ghosted "not yet built" cards, shadow agents priced worst-case, "observed not verified," "evidence not conformance," and outcome signals tagged measured | inferred | none. The app never shows a guessed number as if it were measured.
• The distilled ↔ full-record pairing. Findings is the curated worklist; Activity Log is the exhaustive record behind it. They link bidirectionally, so a user can always move from "what needs a human" to "what actually happened."

1.4 Page inventory by seat (23 pages)

Each seat opens on a seat overview (a launchpad: lensed KPIs + a "your surfaces" card grid), then a flat, arc-ordered list of deep pages:

agent-profile sits outside the nav as a drill target reachable from every roster.

1.5 The new-question value (cycle-history §4)

• Effectiveness ("is it working?") — kept as a persona surface (Eng/Exec) and woven outward: an "Is it working?" card on the agent profile and an "Are the agents earning their keep?" ROI line on the Executive board (success rate, intervention, spend-per-successful-task).
• Activity ("what happened?") — the net-new build: a reconstructed agent → action → target → outcome decision log (filter by family / flagged-only / ties-to-a-finding), event-volume timeline, per-agent rollup, and the honest "shadow agents leave no trail" gap. Seat-lensed: Security = incident response, Compliance = the why-trail behind controls, Engineering = trace a run to the break.

Part 2 — How well does wf5 serve each seat?

Scoring: Served = how completely the seat's daily job is covered (◐ partial / ● strong / ★ core). Grounded in Phase-1 scoring and the seat-composition gap backlog, reconciled against what wf5 ships.

2.1 Security · CISO — ★ strongest seat, now with its forensic loop closed

Their job: govern agent behavior, posture, and credentials — and prove it. What wf5 gives them: the complete control loop — Inventory (who) → Findings (what needs a human) → Posture (how safe, with Hardening-ROI fix-first) → Data Protection (what data) → Policy & Enforcement (what's allowed, with an Enforce dry-run) → Identity (credentials) → Activity Log (what actually happened). Findings lead by enforceability — ungoverned-agent findings jump the queue because you can't make a fix stick outside the governance boundary. Assessment: the best-served seat, and wf5 closes its single biggest hole — there was no "replay what this agent did" trail for incident response; now there is, bridged directly from Findings. Remaining gaps:

1. Capability & Action Authorization matrix — "what each agent may do" (tool/action allow-list) is only hinted inside Policy & Enforcement; it deserves to be a first-class matrix (fold-in, not a new page).
2. Instruction / prompt-change governance — no system-prompt inventory or change control (P3).
3. Posture trend exists but is projected — needs real history to be load-bearing.

2.2 Finance · FinOps — ● now served on both visibility and control

Their job: see, attribute, and control what agents cost. What wf5 gives them: Cost Center (spend by model/agent/user/provider, cache %, governance-tagged spend, honest est labeling) → Usage Limits (per-axis spend ceilings with cap coverage %, an "uncapped" worklist) → Showback (risk-weighted per-identity) → Teams & Users (owner rollup). This is the reversal from c15: Finance went from the biggest gap to a full seat — visibility (Cost Center) plus the forward-looking control (Usage Limits) it was missing. Assessment: well-served for a FinOps practitioner. The "are we on track vs budget" framing and the uncapped-spend worklist give it a real control surface, not just a ledger. Remaining gaps:

1. Showback ≠ chargeback. True P&L/department rollup needs an IdP/SCIM join — currently projected. The unattributable identities (duck.com, proxy-only) are honestly flagged but can't be billed.
2. Cost-efficiency per outcome. $/successful-task now appears on the Executive board but not on the Finance Cost Center — Finance should own that ratio directly.
3. Vendor / provider procurement lens (commit/DPA status, $/token negotiation) — by_provider data exists, no dedicated surface.

2.3 Executive — ● went from "no home" to a packaged board, plus the ROI line

Their job: one board read of governance, spend, and risk — and whether the agents are worth it. What wf5 gives them: the Governance & ROI Board (governance index trended to a target, governed %, $-at-risk with top-N concentration, findings backlog flow, export stub) → now with an "Are the agents earning their keep?" effectiveness/ROI band → Fleet Overview, Cost Center, Usage Limits, Security Posture as drill-downs. Assessment: the clearest net-new win of the whole cycle. The board packages signals that were scattered across operator views, and the ROI line answers the question executives actually ask (value, not just safety). Remaining gaps:

1. executive-home ↔ executive-board overlap. Both still lead with the same four signals. They should be split cleanly: home = live drill hub, board = the exportable, trended report you take to a board. This is the most clear-cut de-dup in the app and is still open.
2. Value-realized over time — "what governance prevented" ($-at-risk avoided, incidents averted) would complete the ROI story; today only forward exposure is shown.

2.4 Engineering · Platform — ● operates the fleet, now across all three dimensions

Their job: build and operate — performance, policy, pipes — and know if agents actually work. What wf5 gives them: Agent Inventory (runtime + lifecycle: active/stale/forgotten/decommission/ shadow) → Effectiveness (task success, sitting above Performance as the outcome layer) → Performance (tail-latency, slow-AND-expensive) → Usage Limits → Policy & Enforcement → Activity Log (trace a run to the break) → Integrations. Assessment: well-served across the three axes that matter — speed (Performance), outcome (Effectiveness), and behavior (Activity Log) — plus lifecycle hygiene for cleanup. The ordering (Effectiveness before Performance) encodes the right priority: did it work, then how fast. Remaining gaps:

1. Agent topology / delegation — in multi-agent systems, who delegates to whom / sub-agent graphs. Ecosystem-native and entirely absent (P3).
2. Effectiveness depends on data the model doesn't fully carry — most outcome signals are inferred, not measured. Honestly labeled, but the surface is only as strong as the instrumentation behind it.

2.5 Compliance · Privacy — ● evidence-strong, now with the audit why-trail

Their job: prove control coverage from agent behavior — honestly. What wf5 gives them: Compliance & Frameworks (findings auto-mapped to OWASP LLM/Agentic, MITRE ATLAS, NIST AI RMF, with a previewable evidence pack — masthead, scope, per-framework why-trails, attestation) → Findings (raw behavioral evidence) → Data Protection → Agent Identity (credential conformance) → Showback → Activity Log (the timestamped, attributable why-trail) → Integrations (GRC/evidence connectors). Assessment: strongly served and honest — "evidence, not conformance" is stated, projected vs live is labeled, and the new Activity Log gives auditors the exhaustive record explainability regulations increasingly demand. Remaining gaps:

1. Agent memory & record retention / data residency — where conversation history, agent memory, and vector/RAG stores live, and how long they're retained. A distinct privacy mandate beyond "which files were touched"; c15 had it, c16 dropped it (P2 — the clearest Compliance add).
2. Content inspection is still a preview (secrets/PII/source scanning with graduated enforcement).

Part 3 — Cross-cutting strengths

1. The lens does the work. Per-seat lensing means the app stays small (one model, ~17 deep pages) while feeling tailored to five very different buyers.
2. Honesty is a feature, not a disclaimer. Estimated costs, worst-case shadow pricing, signal provenance, and "projected" labels make the app trustworthy to read — which is itself the fourth question (Admin) made into a habit.
3. The Findings ↔ Activity pairing is a genuinely strong information-architecture idea: triage and forensics are different jobs, and the app lets you move between them in one click.
4. Value-first headers keep every page answerable in one glance — stake, number, direction, next action.

Part 4 — Areas to improve (prioritized)

Reconciled against seat-composition-review.md: wf5 has now closed all three P1 adds (Usage Limits ≈ budgets, Effectiveness ≈ task outcomes, Activity Log). What remains:

P1 — structural sharpening (no new data needed)

• De-dup executive-home vs executive-board. Make home the live drill hub; board the exportable, trended report. Highest-leverage cleanup; affects the primary Executive buyer.
• Resolve seat-home vs seat-lensed fleet-overview overlap. Both lead with the same KPIs across every seat. Decide: home = thin launchpad, fleet-overview = the dashboard — or merge.
• Promote the Capability & Action Authorization matrix inside Policy & Enforcement (fold-in): "what each agent may do" is the input to "is it safe" and is only hinted today.

P2 — one net-new surface, one buyer

• Agent Memory & Records / Data Residency & Retention (Compliance) — the clearest remaining net-new; a distinct privacy mandate the model can partly support today.
• Cost-per-successful-task on the Finance Cost Center — the ROI ratio currently only lives on the Executive board; Finance should own it. Small lift (the data exists post-Effectiveness).

P3 — ecosystem / roadmap

• Agent Topology / Delegation (Engineering) — sub-agent/delegation graph for multi-agent systems.
• Instruction / Prompt Governance (Security) — system-prompt inventory + change control.
• Real history to make the projected trends (posture, findings backlog, outcome trend) load-bearing rather than illustrative.

Open product question

• Activity Log placement. It currently appears on three seats (Security/Engineering/Compliance) with a seat-lensed register. If "what happened?" is a universal concern, it could instead be a single shared destination (like fleet-overview). Decide based on whether the three registers are different enough to justify three entries.

Part 5 — Seat scorecard

Bottom line: wf5 serves all five seats well and is the strongest pass of the cycle — the persona structure is right, the lensing keeps it lean, and the three P1 surfaces are now all built. The remaining work is mostly sharpening (two de-dups, one fold-in) plus two targeted net-new surfaces (Compliance records-retention, Finance cost-per-outcome). It's ready to graduate its lead pages — Executive Board, Cost Center, Agent Inventory/profile, and Activity Log — to the Phase-3 hi-fi mockups.