Governance v1 Scope

Four sources describe one week of decisions, and they don't agree word for word:

• Mark Parson's Logseq notes from Wednesday 2026-10-21
• Rob Genova's summary of that session
• Mark Peterson's intents PR #4 (merged 2026-10-23)
• Mark Peterson's Slack note on v1 scope

The lab still shows positions those sources overturn: snooze, named drafts with approval, an expiry date required on loosening, Observed findings listed by default, and Resolve adding an exception inline.

The lab reads as v1:

• Policies: mode + Until on both the policy and its exceptions, with reasons required when loosening or revoking.
• Blast radius: a component that says what a change does, on exceptions and on the draft.
• Publishing: one shared Policy Config draft that publishes whole into integer versions, with a JSON view and import.
• Propagation: a footprint on endpoints.
• Findings: filters consolidated, Observed hidden by default, and Resolve as a decision.
• Teams: a posture bar.
• Adoption-stage story: for demos and docs.

• Lab pages, parts and shared world under app/pages/pages/phase4/mock/, app/components/governance/, app/composables/useGovernanceMock.ts, app/composables/useTeamMock.ts and app/data/governance-*.ts.
• /pages/phase4/governance-model (the adoption lifecycle section).
• Records: app/data/c114-review.ts supersessions, and a feedback list for the intents.
• Out of scope: pricing, custom policies, frameworks (next), the qdash port, the demo.qpoint.io world, market-analyst extraction, and layer extractions.

All in design unless noted. Lab pages are under /pages/phase4/mock/.

• Records: f3053d52d opened the cycle (the four sources sorted, D1–D15, wave plans). 85f1e71eb is the Wave 1 → 2 hand-off; 72c164fcc recorded D20–D26 and the Wave 3 PICKUP.
• 00 model (4b472197d, then e6d3fd975): the v1 world in governance-fixture.ts and useGovernanceMock.ts.
  • Mode + Until on policies and exceptions; snooze removed.
  • Every staged edit carries loosens and a reason; a loosening edit or a revoke without one doesn't stage (D1).
  • One shared draft, publishing whole into integer versions (D2, D4, D5); config JSON and import (D13); a fleet with per-endpoint versions (D11).
  • D16: a finding's outcome is stamped at detection; confirmation resolves it "now enforced". D17: one exception per policy and context.
• 01 shared components (0f9d382c2, polish 73c5974a7 d41f597cd 0e488727b 8682f3c00): ModeUntil and BlastRadius (shown as "Change impact", D19), with demos in the parts bin.
• 02 policy detail (a251d279d): the mode strip with Until, required reasons, no snooze, and the impact under every edit. "Who does this apply to?" is gone.
• 03 Policy Config (7b61e97de, Mark's live passes 4687f1b79 8de11b491): Changes renamed Policy Config, with three pages (D26). Proposed Changes holds the draft, its impact and the itemized lines; History holds the versions, propagation and log; Config File holds the JSON, download and import. Old /changes links redirect.
• 04 findings (b91054d43): one filter bar (Outcome · Severity · Status · Framework); Observed hidden by default with a count (D3); Resolve records a decision and links on to the policy (D10).
• 05 teams (807713cef): a posture bar against the organization, with its departures column (D20); matrix and cards stay as options.
• 06 endpoints (a2c10b7ce): the endpoints listing and detail, plus the propagation footprint on team endpoints, version rows, the tray and the policy mode note (D11, D12, D24).
• Change impact rework (5f108309c, Mark's review): a Team | Direction | People table with expandable rows, Tightened · Loosened folded behind "Show details", and "proposed" in place of "pending".
• Older phase-4 pages (e225273cb): they render without the model shims; "blast radius" is out of the copy (D22).
• Lab-wide (c7e21ee91): font-normal → font-reg.
• 07 adoption stage (29451456d): ?stage=adoption|established, a switch in the mock bar that rides every lab link (D14, D25).
  • adoption: every enforceable policy observes organization-wide; Engineering enforces three policies; Dev and Riley pilot one each; nothing loosens. It runs at v3, with the draft "Finance enforces P-MCP".
  • established: the story's world at v13.
  • /pages/phase4/governance-model gains "Exceptions across the adoption lifecycle", and its story lines read "now enforced" (D16).
• 08 records: c114-review.ts marks five Wednesday rulings superseded rather than deleting them (W.1 → D3, W.3 in part → D10, W.4 → D6, W.6 → D1/D7, W.8 named drafts and approval → D4/D5), and /pages/phase4/review-walk shows them. feedback-intents.md goes to Mark Peterson.
• Layer (q-nuxt-layer e0390dc, released as 0.9.34): PolicyTag, PolicyRibbonMark and PolicyDirectionMark (Mark's art), and a FilterTriggerBar caret fix. Design's lockfile resolves 0.9.34; the other consumers still pin 0.9.33.
• Layer 0.9.35 (q-nuxt-layer 8b15751, 35701e1; design lockfile eb2f60b72): severity-* tokens, and SecuritySeverityTag's High and Medium get a full-strength stroke, a pale fill and an ink label. Mark found the old tints too faint against the page.
• Mark's lab pass, 2026-10-23 (7c804d990): the Policy Config submenu reads Config File · History · Proposed Changes. The publishing tray closes to a chip, and staging an edit reopens it. Lab links no longer carry ?dp, so every page opens at phase 4 with exceptions shown. The mock bar folds its knobs behind "controls ▸" and names any that are off their default. These shipped uncommitted in the 2026-10-27 deploy.
• Deploy (2026-10-23): design f6ddd3557 plus 40 uncommitted paths (other sessions' work, shipped as the lab does), layer 0.9.35, on design-f39.pages.dev. Verified there in both stages.
• Illustrator: 6213b531b fixed the export; illustrator/c121-changes-draft-impact-v4.ai is the draft-impact page in Illustrator.

The lab reads as v1:

• Policies carry a mode with an optional Until, on the policy and on its exceptions, and a loosening edit or a revoke needs a reason.
• Every edit shows its change impact before it's staged, and so does the draft.
• Publishing is one shared Policy Config draft that publishes whole into integer versions, with JSON and import.
• Endpoints show how far each version has reached.
• Findings hide Observed by default, and resolving one records a decision.
• Teams read as a posture bar against the organization.
• Both adoption stages can be shown on every lab page, and the docs explain them.

What Mark Peterson's intents still need from us is in feedback-intents.md: two places we went further (required reasons, local staging), four open questions answered, D16's naming, and four superseded intents still in the repo.

Not done, carried forward:

• PolicyTag needs a removable variant for the Findings policy filter chip, and a design-site docs entry.
• Endpoint activation history is derived; the intent wants it stored.
• /organization/teams overflows horizontally at 1280–1440px. This predates c121.
• The qdash port, the demo.qpoint.io world (D25), and frameworks as the entry point (W.11, next per Mark Peterson).
• BlastRadius and ModeUntil are layer-extraction candidates.
• bob-wire, www, qflow and qdash pin layer 0.9.33.

Product-session decisions

What the Qpoint Product sessions decided, as this cycle carries it. Attendees: Mark Parson, Mark Peterson (advisor), Rob Genova, Tyler Flint. Transcripts are extracted in market-analyst: Wednesday 5c8785e2 (2026-10-21) and Friday 5b4bae13 (2026-10-23). Status words: ruled, direction, open, idea. A later session wins over an earlier one. Recorded 2026-10-26.

The story. The Wednesday session was the last word on the v1 model, and it got there by subtraction. Snooze, policy groups, the per-person simulator, named drafts and approvals all went. What stayed fits on one policy page and one Policy Config file. Mark Parson's takeaway (53:33): "The policy is where everything happens." This cycle built it. On Friday the team walked the built lab. Rob: "we're not looking at Illustrator right now." The conversation then moved past a policy's settings to what is inside a policy, which is the next cycle's question.

Ruled Wednesday 2026-10-21, built here

• Exceptions replace policy groups. An exception's context is org, team or user; device groups wait for MDM. Groups exist only as what exceptions add up to at runtime, and frameworks are the only predefined grouping. Ruled. → 00 model; team Policies (05).
• Mode is Off · Observe · Enforce with an optional Until, on the policy and on its exceptions, with the same control in both places. Snooze goes. Ruled. → ModeUntil, D6.
• A reason when loosening, and when revoking an exception early. The session asked for a strong nudge ("put it in red") that doesn't add friction. Mark ruled it required here (D1), which is on the feedback list. Ruled, made stricter here.
• Expiry is optional. Mark Parson proposed requiring an end date when loosening; Mark Peterson kept it optional. This overturns c118 W.6, ruled that morning. Ruled. → D7.
• Show a change's impact before it's made: the people and teams it touches, and the findings it would resolve or reopen. Ruled. → BlastRadius, shown as "Change impact" (D19).
• One shared draft for v1. Every admin's edits go into it, publishing makes all of it live, and there's no approval at first. Multi-draft conflict handling waits until customers show how many admins edit and how often. This overturns c118 W.8 and L8b, from the same day. Ruled. → D4, D5, and Policy Config (03).
• "Policy Config" is the name, and a version is the whole file (v12, v13), viewable and downloadable as JSON, with import. Ruled. → D2, D13, D26.
• Propagation per version. Endpoints that haven't picked up a version, such as offline laptops on a shelf, are flagged with a pointer to the MDM. Ruled. → D11, D12, D24. A view in Monitor stays future work.
• The per-person cascade simulator is cut. In the session, needing a helper to explain the cascade was read as a sign of friction elsewhere. Rob asked to keep the exploration as backlog. The session leaned toward cutting it, and c121 cut it. → 02 removed "Who does this apply to?".
• The policy header carries frameworks, organization severity with Qpoint's recommendation, and open findings. Ruled. → 02.
• The teams listing shows each team's posture: a proportional Enforced / Observed / Off bar against the organization, the team's exceptions, and open findings. Ruled. → D20.
• Findings: "not enforced" becomes Observed, an Enforced finding means the activity was blocked, and there are filters for severity, framework and state. Ruled. → 04, D3, D16.

Confirmed Friday 2026-10-23, in the review of this lab

• Mark Parson walked the lab: the policy page with mode, severity and exceptions; the org-wide draft published atomically; impact by policy, team and person; history with rollback; findings grouped or flat. Tyler, Rob and Mark Peterson asked for no changes to any of it.
• Mark Peterson restated that Resolve only acknowledges and documents what was observed, and never changes enforcement. That is D10.
• He also asked for a demo that shows both a new customer's onboarding and a mature deployment as the goal. 07's adoption stages are that.
• Upload as well as download a config, plus starter configs: a standard one, and industry ones such as banks or PCI DSS. Import exists (D13); shipped starter configs are new. Direction.
• The Teams posture page didn't load during the review. Not reproduced here.

Sent forward, not built here

• Frameworks and compliance are next. Mark Peterson is defining the framework views, which policies a framework brings in or lets an admin take out, and the defaults, to go over with Mark Parson on Monday 2026-10-26. Direction.
• What is inside a policy: explicit and implicit rules.
  • Explicit rules are conditions on the action, user and endpoint, plus lists the operator defines (approved MCP servers).
  • Implicit rules are intent questions judged at run time. Each has its own probability threshold and the context it needs (identity, the external resource, the skill's content).
  • Built-in policies ship default questions that the admin can switch on or edit. Implicit rules can also sit on an exception, for example looser rules for the dev team.
  • Whether implicit rules show on the policy or in a list of their own is open.
  • Direction (Tyler, Mark Peterson).
• Control and policy are different levels. A framework's control, within a control family such as NIST 800-53 AC, sits above our policies, and several policies can serve one control. Mark Peterson suggested showing "control intents" beside the policies. This touches c114 D4, which keeps Control as qdash's internal word for the rule. Open.
• Each policy shows which action types it evaluates (Rob). The engine skips a policy for unrelated actions, so this is real and cheap to show. Direction.
• Built-in policies stay editable: their lists, implicit questions and exceptions. A builder for customer-written static policies is not in phase one. Direction.
• A naming convention for policies, along the lines of action, descriptor, object. Mark Parson and Mark Peterson are sketching the real policy structure. Open.
• A learning loop. MCP servers allowed by an implicit rule can be offered for the explicit list, and new exceptions and rules can be suggested on a regular review. These could feed a continuous-monitoring report. Idea.
• Outside design. Pricing: by endpoint, not by framework; the free tier is gated on scale, not features (Wednesday). Installers: the first ones ship without the central UI, with a local audit-log viewer in the tray (Friday). Rob is starting a list of the minimum built-in policy set.

• D1 (Mark, 2026-10-23): a reason is required when an edit loosens (to a policy's mode or to an exception) and when an exception is revoked. Save stays disabled without one. Tightening keeps the reason optional. This goes further than the intent's non-blocking prompt, so it is on the feedback list.
• D2 (Mark, 2026-10-23): versions are integers: "Policy Config v13". The draft reads "v13 · 6 pending changes". The note's "v13.6" means pending changes, not a version scheme.
• D3 (Mark, 2026-10-23): Observed findings are hidden by default, with a one-click filter and a zero state that names what is hidden. This supersedes W.1's default.
• D4 (Mark, 2026-10-23): local staging stays, in front of one shared draft. "Save to draft" writes the staged edits into it, with an author per change. Publish takes a note and makes the whole draft live. There are no named drafts, approvals or promotes. The intent saves edits straight into the draft, so this is on the feedback list.
• D5–D15 (Mark, 2026-10-23): accepted as written in plan/README.md §2 ("lets start", after the walk-through). The two open asides stay open: other places for the propagation footprint (D12), and whether "demos" means the qdash demo world (D14).
• D16 (Mark, 2026-10-23):
  • A finding's outcome, Enforced or Observed, is stamped at detection and never changes. Enforced means the activity was actually blocked.
  • When enforcement is confirmed later, an open Observed finding resolves by re-evaluation, with the cause "now enforced on this endpoint". It still reads Observed.
  • This supersedes c114 D3's "resolve as Enforced" (I: resolve and re-evaluate intents).
• D17 (Mark, 2026-10-23): one exception per policy and context. Adding one for a context that already has one edits the existing exception, and history keeps the old value.
• D18 (Mark, 2026-10-23): Observe is grey everywhere: mode chips, posture bars and tags. Amber is kept for warnings, such as hidden Observed findings and a lapsing Until.
• D19 (Mark, 2026-10-23): no size judgement on a change's impact, and "blast radius" stays out of the UI. The impact's headline states the facts and stops ("Loosens P-MCP for 3 people in Finance."). The parts bin calls the component "Change impact"; code may keep the name BlastRadius.
• D20 (Mark, 2026-10-23): the teams listing defaults to the posture bar, always shown with its "Against the organization" departures column. The matrix and cards views stay as switch options (?v.posture=).
• D21 (Mark, 2026-10-23): keep the seeded blocked-at-detection findings (F-D, F-E, F-F) and the six extra Engineering members (Noor, Mateo, Hana, Kofi, Lena, Ravi).
• D22 (Mark, 2026-10-23): the "blast radius" reword also stands on the pre-c121 mock policy-config-no-root-execution.vue (D19 applies everywhere).
• D23 (Mark, 2026-10-23): a change that only moves an end date says what it keeps: "Keeps Jordan on Observe until Dec 15 (was Nov 15)." It no longer says "No one's mode changes."
• D24 (Mark, 2026-10-23): the propagation footprint (D12) stops at Endpoints, team endpoints, the Changes version rows, the tray and the policy mode note. The Monitor view stays future work.
• D25 (Mark, 2026-10-23): the adoption stage is a lab switch plus a docs section only. No qdash demo-world work follows from it.
• D26 (Mark, 2026-10-23): the Changes page is renamed Policy Config. In the rail it opens a submenu of three pages:
  • Proposed Changes: the draft, its impact and the itemized changes. Policy Config lands here.
  • History: versions, propagation and the log.
  • Config File: the JSON view, download and import.
  
  The tray links to Proposed Changes, and old /changes links redirect there.
• Impact-card rework (Mark, 2026-10-23, live review):
  • Teams table: Team | Direction | People. A member counts as looser if anything loosens them, otherwise stricter. Dot clusters, then avatars fitted to one line.
  • Expandable team rows: Policies at play, then Per Person Impact (each move with "via …").
  • Tightened · Loosened: on one line, folded behind "Show details".
  • The new state is underlined.
  • "Pending" → "proposed". The header reads "Policy Config v13 Draft · 12 proposed changes".
  • New layer pieces: PolicyTag (with iconScale), PolicyRibbonMark and PolicyDirectionMark, using Mark's art.

Three waves, with a review gate after each:

1. Model + shared components: 2 executors in parallel.
2. Surfaces: 5 executors in parallel: policy detail, publishing, findings, teams, endpoints.
3. Serial: adoption stage, records, captures, deploy.

File ownership and contracts are in plan/README.md §3–5.