Source: c124 cycle-stories, option B. One 1440 × 900 screen answers why, what changed and who helped; the detail sits below the fold.
Governance v1 Scope
Why: One week of conversations with our CISO advisor reshaped the governance model, and the lab still showed the positions those conversations had overturned: snooze, named drafts with approval, required expiry dates, noisy findings.
In plain words: Think of a company's rules for its AI helpers as a set of light switches: off, watch, or block. This week we agreed each rule gets one switch, and if you ever loosen a switch you have to say why. Before you flip it, the screen tells you exactly who it affects. All the flips wait in one shared cart and go live together, like checking out. This cycle made every screen in the lab work that way.
What changed
Decisions and where they came from
Solid = cited in the record. Dashed = matched by the draft from artifactRef, date and topic, waiting for review. Click a row for its sources.
| ID | Decision | Ruled by | Came from | Link |
|---|---|---|---|---|
| D1 | A reason is required when an edit loosens and when an exception is revoked. Tightening keeps it optional. | Mark Parson 2026-10-23 | Mark Peterson | matched · review |
| D3 | Observed findings are hidden by default, with a one-click filter and a zero state that names what is hidden. | Mark Parson 2026-10-23 | Mark PetersonRob Genova | matched · review |
| D4 | Local staging stays, in front of one shared draft. Publish makes the whole draft live. No named drafts, approvals or promotes. | Mark Parson 2026-10-23 | Mark PetersonTyler Flint | cited |
| D6 | Mode is Off · Observe · Enforce with an optional Until, on the policy and on its exceptions. Snooze goes. | Mark Parson 2026-10-23 | Mark Peterson | cited |
| D7 | Expiry is optional. Mark Parson proposed requiring an end date when loosening; Mark Peterson kept it optional. | Mark Peterson 2026-10-21 | Mark Peterson | cited |
| D13 | Import validates a pasted or uploaded JSON into the staged edits. A support export strips tokens. | Mark Parson 2026-10-23 | Mark PetersonRob Genova | cited |
| D16 | A finding's outcome, Enforced or Observed, is stamped at detection and never changes. | Mark Parson 2026-10-23 | Rob Genova | matched · review |
| D19 | A change's impact states the facts and stops ("Loosens P-MCP for 3 people in Finance."). "Blast radius" stays out of the UI. | Mark Parson 2026-10-23 | Mark Peterson | cited |
| D20 | The teams listing defaults to the posture bar, with its "Against the organization" departures column. | Mark Parson 2026-10-23 | Mark Peterson | cited |
| D24 | The propagation footprint goes on Endpoints, team endpoints, the Changes version rows, the tray and the policy mode note. | Mark Parson 2026-10-23 | Mark Peterson | cited |
| D25 | The adoption stage is a lab switch plus a docs section. | Mark Parson 2026-10-23 | Mark Peterson | cited |
| D26 | Changes is renamed Policy Config: Proposed Changes, History and Config File. | Mark Parson 2026-10-23 | Mark Peterson | matched · review |
The record 9 Key Changes · 26 decisions · 2,270 words · 28 captures
Today's page is 7,300 px of record. Key Changes, every decision, artifacts and the full visual record stay on the record page.
Open the record for c121 →