Source: c124 cycle-stories, option C. The provenance is the spine: who said it → what we decided → what changed. Fixture from the c121 record and market-analyst calls.
Governance v1 Scope
activeWhy: One week of conversations with our CISO advisor reshaped the governance model, and the lab still showed the positions those conversations had overturned: snooze, named drafts with approval, required expiry dates, noisy findings.
In plain words: Think of a company's rules for its AI helpers as a set of light switches: off, watch, or block. This week we agreed each rule gets one switch, and if you ever loosen a switch you have to say why. Before you flip it, the screen tells you exactly who it affects. All the flips wait in one shared cart and go live together, like checking out. This cycle made every screen in the lab work that way.
How we got here
A policy now has one Off · Observe · Enforce switch with an optional end date, on the policy and on each exception.
Mode is Off · Observe · Enforce with an optional Until, on the policy and on its exceptions. Snooze goes.
← Mark Peterson, 2026-10-19
← Mark Peterson, 2026-10-21
Expiry is optional. Mark Parson proposed requiring an end date when loosening; Mark Peterson kept it optional.
← Mark Peterson, 2026-10-19
A reason is required when an edit loosens and when an exception is revoked. Tightening keeps it optional.
← Mark Peterson, 2026-10-19 (matched · review)
Every edit shows the people and teams it touches, and the findings it would resolve or reopen, before you stage it.
A change's impact states the facts and stops ("Loosens P-MCP for 3 people in Finance."). "Blast radius" stays out of the UI.
← Mark Peterson, 2026-10-21
← Mark Peterson, 2026-10-21
Edits collect in one Policy Config draft; publishing makes the whole file live as the next version, viewable and importable as JSON.
Local staging stays, in front of one shared draft. Publish makes the whole draft live. No named drafts, approvals or promotes.
← Mark Peterson, 2026-10-14
← Mark Peterson, 2026-10-14 (matched · review)
← Tyler Flint, 2026-10-19
Import validates a pasted or uploaded JSON into the staged edits. A support export strips tokens.
← Mark Peterson, 2026-10-21
← Rob Genova, 2026-10-21 (matched · review)
← Mark Peterson, 2026-10-23
Changes is renamed Policy Config: Proposed Changes, History and Config File.
← Mark Peterson, 2026-10-21 (matched · review)
Observed findings hide by default, and resolving one records a decision instead of changing enforcement.
Observed findings are hidden by default, with a one-click filter and a zero state that names what is hidden.
← Rob Genova, 2026-10-21 (matched · review)
← Mark Peterson, 2026-10-19 (matched · review)
A finding's outcome, Enforced or Observed, is stamped at detection and never changes.
← Rob Genova, 2026-10-14 (matched · review)
The teams listing reads as a posture bar: each team's Enforced / Observed / Off against the organization.
The teams listing defaults to the posture bar, with its "Against the organization" departures column.
← Mark Peterson, 2026-10-21
Endpoints show how far each version has reached, so a laptop sitting offline on a shelf gets flagged.
The propagation footprint goes on Endpoints, team endpoints, the Changes version rows, the tray and the policy mode note.
← Mark Peterson, 2026-10-21
Every lab page can show a new customer's onboarding stage or a mature deployment, and the docs explain both.
The adoption stage is a lab switch plus a docs section.
← Mark Peterson, 2026-10-23
The record 2,270 words · 9 key changes · 26 decisions · 28 captures
Key Changes, every decision, artifacts and the full visual record stay as written in CYCLE.md. Open the live c121 page →