Policy Structure and Publishing

The 2026-10-19 product session changed the object model c114 drew and the changeset model c116 proposed.

• Policy groups stopped being an object.
• Enforcement mode moved up to the policy.
• Exceptions became the only way to vary a policy.
• Ignore and Block left the finding.
• Publishing became a separate, deliberate act.

The initial prompt framed c118 as writing those changes into design's records. The lab plan changed that: the composed mocks were the cheapest place to see whether the landings held together, and the next session was a day away.

• Ruled items (brief A1–A5, B1, B3) are drawn as the lab's one model, with no options.
• Direction items (B2, B4, B5, C4–C6) are drawn as two or three options each, switchable by URL, so Wednesday could flip between them live.
• Later items (advanced exceptions, test endpoints, approvals, conflicts) stay out.

• The lab under /pages/phase4/mock/, its fixture (app/data/governance-fixture.ts, useGovernanceMock), the model page and the review walk's W stop.
• The brief's record steps (§6 of the lab plan, R1–R7) were planned here.

• Plan (2026-10-20): 31e7fb226, with §8 answered by Mark (27741690e). The answers include: no Scope object; an exception can set any mode, in either direction; a snooze is Observe until a date; exception contexts are org, team and user; tracking a framework brings its policies in at Observe.
• L1 · L6 (2026-10-20, 66879100b): the Oct 19 model in the fixture (policy mode, mode exceptions resolved narrowest-first, no stored groups, resolve reasons, the snooze), with c114's model kept as C114_RULED for the record pages. The live Policies copy's toggle became a three-state mode.
• L2–L5 (2026-10-20): S3 gets the mode, the snooze, and Exceptions as the nuance section, and Scope + enforcement retires (0308b858e). S1 Resolve takes a reason, and Block and Ignore are removed (4cbad5323). S2 gets observe options, mode tags and Resolve in the card (e887fa831). The live team page comes into the lab with a derived Policies section, which replaces S7 Policy Group (bc1076add).
• L7 + deploy (2026-10-20): the Wednesday agenda as stop W of the review walk, 11 questions (77b0419b2), deployed to design-f39.pages.dev.
• Wednesday walk (2026-10-21, before the session): Mark ruled W.1–W.10 on the walk (10dc34c94). L9 built W.1–W.3 and W.6 (a526d7785). L8 built publishing as W.8 ruled it: local edits, server drafts, approve and promote, versions, rollback by pointer (0beb2f879). L8b made approval an organization setting (02bbfe261). Then came a run of tray and mode-hint refinements, ending at 06b083095.

The Oct 19 model ran end to end in the lab within a day: S3, S1, S2, the Policies copy and the team page all read one world where a policy has a mode, exceptions carry the nuance, and groups are derived. The review walk turned the open items into eleven questions, and Mark ruled ten of them on Wednesday morning.

Five of those rulings were revised soon after: by the product session that afternoon, and by the sources c121 sorted on 2026-10-23. c121 built the revised set that day, so much of this lab's publishing work (named drafts, approve and promote, the approval setting) was superseded within two days. It is kept, not deleted: c121 marks the superseded rulings in app/data/c114-review.ts and the walk shows them.

Not done: the brief's record steps R1 (c114 D10+), R2 (object-model.md still describes c114's model of 2026-10-09), R5 (the c116 rewrite), R6 (Rob's one-pager for a beta customer) and L6b (framework tracking previews). R7, the intents, moved to c121's feedback-intents.md.

Product-session decisions

What the Qpoint Product sessions decided, as this cycle carries it. Attendees: Mark Parson, Mark Peterson (advisor), Rob Genova, Tyler Flint. Transcripts are extracted in market-analyst: 154b2679 (2026-10-19) and 5c8785e2 (2026-10-21). The source for Oct 19 is the market-analyst brief, cited as A1–D4. Status words: ruled, direction, open, superseded. A later session wins over an earlier one. Recorded 2026-10-26.

The story. Oct 19 was the session where the model collapsed into one place. Every concern got one policy, and every difference became an exception on it. This cycle proved the collapse in the lab in a day. Its publishing half was the most contested ground of the week. It went from one locked draft (Oct 19), to several server drafts with approval (Mark's walk, Wednesday morning), to one shared draft with no approval (the session that afternoon). The last of these is what shipped in c121.

Ruled on Oct 19, drawn here, still standing

• One policy per area of concern. The policy holds its definition, severity, mode, exceptions and knobs (A1). Ruled. → L1, L2.
• Mode on the policy: Off · Observe · Enforce (A2). Ruled. The control sits in S3's overview strip (W.2, Wednesday morning, still standing). → L2, L6.
• Exceptions are the only way to vary a policy, by org, team or user context, with the narrowest winning (A3, A4). A person in two teams gets the stricter (W.5, c114 D9). Ruled. → L1, L2. Advanced exceptions, which vary a policy's knobs, are later. c121 narrowed v1 to exceptions that change mode only.
• Policy groups are derived, not stored, and they show under the team (A5, W.7). Ruled. → L5.
• Block is gone from findings (B1). Ruled. → L3.
• Resolve takes a reason: False positive · By design · Security testing · Other (B2, W.3). Ruled. → L3, L4.
• Rollback moves the live pointer and is logged as its own event (C2, W.9). Ruled. → L8. c121 kept the history and rollback.
• Propagation is shown per version (W.10). Ruled. → L8, then c121 D11–D12.

Superseded after this cycle drew them

• Snooze, i.e. ignore moved to the policy (B3, B5, W.4). Wednesday's session replaced it with a mode plus an optional Until. → c121 D6.
• A required by-when on a loosening exception (W.6, Wednesday morning). The session made expiry optional that afternoon. → c121 D7.
• Observe findings listed and tagged by default (W.1). Mark then ruled them hidden by default, with a filter and a zero state. → c121 D3.
• An exception created inline from Resolve (W.3, in part). Resolve now records a decision and links on to the policy. → c121 D10.
• One draft at a time with a lock (C4, Oct 19), then several server drafts with approve and promote (W.8, L8, L8b, Wednesday morning). Both gave way to one shared draft with no approval in v1 (Wednesday afternoon). → c121 D4, D5.

Workshopped on Oct 19 and dropped, so don't revive them: several instances of a policy per team; "ditch exceptions"; Ignore on a single finding; Ignore as an "Informational" severity; groups created up front and applied later; a separate test server.

Left open here and settled elsewhere

• Frameworks as the entry point (A6, W.11): tracking a framework brings its policies in at Observe. It was not drawn here (L6b). Frameworks are the subject of the next session (2026-10-26).
• Test endpoints as a scope, with promotion from test (D1–D3). Direction, after beta. Not drawn.