Source: c124 cycle-stories, option A. The story read top to bottom like a post; the record folds at the end. Fixture: app/data/cycle-stories-mock.ts.
Governance v1 Scope
One week of conversations with our CISO advisor reshaped the governance model, and the lab still showed the positions those conversations had overturned: snooze, named drafts with approval, required expiry dates, noisy findings.
Problem: problem:safe-to-enforce — Safe to enforce
Think of a company's rules for its AI helpers as a set of light switches: off, watch, or block. This week we agreed each rule gets one switch, and if you ever loosen a switch you have to say why. Before you flip it, the screen tells you exactly who it affects. All the flips wait in one shared cart and go live together, like checking out. This cycle made every screen in the lab work that way.
“The policy is where everything happens.”
What changed
7 outcomes. Drag the divider to compare before and after.
Everything on the policy page
A policy now has one Off · Observe · Enforce switch with an optional end date, on the policy and on each exception.
See who a change affects, first
Every edit shows the people and teams it touches, and the findings it would resolve or reopen, before you stage it.
One shared draft, published whole
Edits collect in one Policy Config draft; publishing makes the whole file live as the next version, viewable and importable as JSON.
Findings without the noise
Observed findings hide by default, and resolving one records a decision instead of changing enforcement.
How special-snowflakey is each team?
The teams listing reads as a posture bar: each team's Enforced / Observed / Off against the organization.
Which laptops missed the update
Endpoints show how far each version has reached, so a laptop sitting offline on a shelf gets flagged.
Day one and the goal, side by side
Every lab page can show a new customer's onboarding stage or a mature deployment, and the docs explain both.
Thanks to
The people outside Qpoint come first. Every credit is sourced: solid chips are cited in the record, dashed chips were matched by the draft and wait for review.
Shaped the v1 model across four sessions
Moved mode onto the policy and retired snooze; asked to see a change's impact before making it; kept expiry optional; proposed the team posture bar, propagation per version, config import and the onboarding-vs-mature demo. His intents PR #4 and v1 scope note set the cycle's scope.
“You might be able to do sort of, like, a bar that shows proportionally... how special snowflakey are they?”
Kept findings honest and exports safe
Asked for each finding to keep the policy version it was detected under (D16), flagged the findings flood from agents running wild (D3), and caught that exported configs could carry tokens (D13).
“Agents, you know, tend to kinda run wild... there might be a ton of attempts.”
Named the hardest problem, so v1 could skip it
Called multi-draft conflict resolution the hardest thing on the roadmap; v1 ships one shared draft and waits for real usage.
“Of all the things that we're doing, this is the hardest, like, without question.”
Walked the lab and ruled D1–D26
Turned the week into the lab: made the loosening reason required, renamed Changes to Policy Config, and ran the Friday walkthrough where nobody asked for changes.
How we got here
The conversations behind the cycle, by date, and what each one turned into.
- 2026-10-14 · advisory callPolicies, groups, exceptions, the findings lifecycle
Stage and version policy changes like a code review; the staged-changes "shopping cart" reads as intuitive.
Mark PetersonRob GenovaMark Parson- Mark Peterson: Policy changes should be staged, versioned, reviewed and deployed deliberately, like a code review, rather than toggled live. → D4
- Mark Peterson: The "shopping cart" staged-changes metaphor (local edits, save, submit) is highly intuitive. → D4
- Rob Genova: Changing a policy makes earlier findings ambiguous unless each finding keeps the policy version active when it was detected. → D16
- 2026-10-19 · advisory callMode moves to the policy
Off · Observe · Enforce at the policy level, time-bounded; findings resolve with a reason.
Mark PetersonTyler FlintMark ParsonRob Genova- Mark Peterson: Ignore and snooze belong at the policy level (off / observe / enforce), time-bounded, so suppressed findings stop polluting the stream. → D3D6
- Tyler Flint: Change-set conflict resolution is the hardest problem on the roadmap and could expand scope a lot. → D4
- Mark Peterson: An exception always comes with a by-when commitment, an SLA. → D1D7
- 2026-10-21 · advisory callWednesday: the v1 model, by subtraction
Snooze, policy groups, the simulator, named drafts and approvals all went. What stayed fits on one policy page and one Policy Config file.
Mark PetersonMark ParsonRob Genova- Mark Peterson: Strongly endorsed previewing a change's impact on exceptions: it communicates why a change matters before it's made. → D19
- Mark Peterson: Show affected people, teams and the findings a change would resolve or reopen before granting an exception. → D19
- Mark Peterson: Show policy-version propagation across endpoints, citing returned intern laptops that sit offline and miss updates. → D24
- Mark Peterson: An exportable and importable policy config (JSON) helps support reproduce issues and customers migrate. → D13D26
- Rob Genova: Exported config files may embed plugin credentials, which complicates support workflows. → D13
- Mark Peterson: A proportional bar on the team listing comparing each team's enforced vs. excepted policies against the org baseline. → D20
- Mark Peterson: "Snooze" was confusing; unify it with the mode-based pattern (Observe / Enforce). → D6
- Rob Genova: Agents running wild could flood findings with repeated attempts; there needs to be a way to keep that noise down. → D3
- 2026-10-23 · advisory callFriday: walking the built lab
No changes asked for. Onboarding vs mature demo, config upload and starter configs, frameworks next.
Tyler FlintMark ParsonRob GenovaMark Peterson- Mark Peterson: Show a new customer's onboarding and a mature deployment side by side, as the journey from mostly-observe to mostly-enforce. → D25
- Mark Peterson: Upload as well as download a policy config, plus starter configs: standard, and industry ones such as banks. → D13
The record
Today's page is 7,300 px of record. The full record — Key Changes, every decision, artifacts and the visual record — stays one click away.
Open the record for c121 →