Phase 4
Review walk
Source: c114 governance-phase2 — Phase 4, the walk through the eight surfaces · 2026-10-09
One surface at a time, in the order they depend on each other. Each stop has where to look, what to look for, and the questions the mock raises, with what it does today so a ruling can be "keep". Rulings are recorded in app/data/c114-review.ts and CYCLE.md Decisions, and show here as they land. Captures come from the atlas by subject.
Progress
1 of 36 questions ruled · 0 of 8 surfaces completeS1 Finding detail 0/4S2 Findings 0/4S3 Policy detail 0/6S4 Policies & Frameworks 0/4S5 Framework detail 0/4S6 Scope & enforcement change 1/3S7 Policy Group 0/3S8 Resolve with Ignore · Create exception 0/4W Wednesday 10-21 10/11X Cross-cutting 0/4
Delivery phases (Mark Peterson, 2026-10-09)
P2 Foundation — Policies, Findings, Severity, Resolution; policies organisation-wide, no scopes or groups.
P3 Organization — Policy Groups as membership; Frameworks with many-to-many mappings.
P4 Applicability & Enforcement — Scopes and assignments, scoped enforcement, Exceptions, context-aware re-evaluation.
Rulings so far
D0 Model first: the intents are read for the object model, not executed one per page.
D1 Scope precedence is CSS specificity: org < team < user or device; an exception is a more specific allow; equal-specificity conflicts are shown, never resolved silently.
D2 Re-evaluation is forward-only and can reopen; severity changes only reprioritise.
D3 Enforcement has two states beyond observe, configured and confirmed, per device; a finding resolves as Enforced on confirmation.
D4 The intents' words wherever a practitioner reads: Policy, Framework, Finding, Resolution, Scope, Exception, Group.
D5 All eight surfaces, in dependency order.
D6 Backend not started; design leads; no fixed date.
D7 The mocks live under Phase 4 — Governance on the design site.
D8 The model is the base; existing pieces are reused where they fit it and changed or retired where they contradict it.
What the 2026-10-19 session left as direction or open, drawn in the lab (c118, 2026-10-20). Each item links to the states that answer it; the options are slot variants, and the links turn on "show parts" so the switch is on the page.
- Ruled 2026-10-19: one policy per concern holding all its configuration (A1); mode on the policy, Off / Observe / Enforce (A2); exceptions are the only nuance, mode now and advanced later (A3); the narrowest context wins (A4); policy groups become a view under the team (A5); Block is removed (B1); Ignore moves to the policy (B3).
- Answered by Mark 2026-10-20 (c118 lab-plan §8): no Scope object, a mode exception works in both directions (Q2); an exception can set the mode (Q3); a snooze is Observe until a date, through the draft (Q6); contexts are org / team / user (Q7); turning a policy Off resolves its findings as Policy changed (Q9); framework policies arrive in Observe (Q10).
W.1
B4
Findings from policies that are not enforced for their person: hidden by default, shown and tagged, or in a tab of their own as the preview of enforcement?
Drawn: All three, on the Findings page. Hidden is the default (the initial prompt's reading); tagged is the brief's "filter off by default"; the preview tab is "Observe doubles as a preview". · options: hidden / tagged / preview tab
ruled Tagged: listed with their mode tag, and a simple way to filter them out of the results, in the manner of the filter trigger bar (a filter, not a separate chip or tab). — Mark, 2026-10-21superseded c121 D3: Observed findings are hidden by default, one filter click away; once included they keep this tag
W.2
A2 · §5 "what the three modes look like"
Where does the mode sit on policy detail: its own section leading the page, also in the overview strip beside severity, or also beside the title in the sticky band?
Drawn: The Mode section always leads (control, what it does, "If you switch", snooze); the strip and header variants add a compact control. · options: section / strip / header
ruled Strip: the mode control sits in the overview strip, and the strip (Mode · Framework(s) · Organization Severity · Findings) moves above the four definition paragraphs, with a hairline between the two. — Mark, 2026-10-21
W.3
B2
Resolve: are False positive · By design · Security testing · Other the right four, with the explanation required only for Other? And does the optional exception lead, or follow the reason?
Drawn: Reasons first by default; the explanation is recommended, required for Other; "Also stop it coming back" adds an Off exception for the user, team or organization, previewed. The same capture on the finding page and in the list's card. · options: reasons first / exception first
ruled Reasons first; the four reasons stand as drawn. The exception's until gets a checkbox, checked by default (dated); unchecked, it reads "Indefinite". Kept after W.6: Resolve's exception is exempt from W.6's required date. — Mark, 2026-10-21superseded c121 D10, in part: Resolve records a decision and adds no exception; a link opens the policy's exceptions instead. The four reasons, reasons first, stand
W.4
B3 + B5
Is "Too noisy? Quiet the policy →" (the snooze when it enforces, the mode or an exception otherwise) the right replacement for Ignore on a finding? And may a snooze be indefinite, or always dated?
Drawn: The link sits under Resolve and in the card; the snooze form asks for a date (two weeks out by default); a snoozed policy gets a line on Findings and "observing until …" everywhere its mode shows.
ruled The quiet link stays where it is drawn (under Resolve and in the card). A snooze is always dated (revised after W.6, from a radio pair Until ⟨date⟩ · Indefinitely): an indefinite quiet is switching the mode to Observe. — Mark, 2026-10-21superseded c121 D6: the snooze goes; a policy's mode takes an optional Until and reverts to the mode it replaced
W.5
§5 "a user in two teams"
A person in two teams whose exceptions disagree: does the stricter win (c114 D9, as drawn), or does something else decide?
Drawn: Stricter wins. Alex is in Engineering (Observe on the MCP policy) and Finance (Enforce): Enforce. Shown as a tie note on both exceptions and on the team page. · options: stricter wins / the primary team / show a conflict
ruled Stricter wins (c114 D9 holds under the Oct 19 model), as drawn. — Mark, 2026-10-21
W.6
A7 · §5 "a mandatory by-when"
Does an exception need a by-when, or is it optional?
Drawn: Optional: blank is indefinite. A dated one lapses on its date, re-evaluates, and shows amber in the table (User A's on the personal-account policy). · options: optional / required / required for some contexts
ruled Required when the exception loosens (sets a lower mode than the one it overrides); optional when it tightens, since a tightening exception can be the policy's permanent shape (a Finance-only policy is org Off + Finance Enforce). Held weakly. Resolve's exception is exempt (W.3); a snooze is always dated (W.4). — Mark, 2026-10-21superseded c121 D1 and D7: the end date is optional everywhere (a hint when loosening, never a block); a loosening edit requires a reason instead
W.7
A5
The team page's Policies section as the home of "what applies to this team": the right content (mode for the team, what sets it, members who differ, open findings) and the right place?
Drawn: On the copied live team page, after Sessions; read-only, rows link to the policy's Exceptions. A Teams listing opens it.
ruled Yes: the content and the place stand as drawn. — Mark, 2026-10-21
W.8
C4 · §5
One draft at a time for beta: is the draft local to one browser or on the server? And how does an urgent fix get out while someone else's draft is open: discard, take over, or a break-glass publish?
Drawn: Not in the lab yet (L8, after this session). c116's indicator and review page show the draft as personal named changesets, which C4 supersedes. · options: server draft / local draft
ruled Not git. Working edits are local, across pages of the dash; submitted, they become a draft on the server: a list of changes against the live configuration, reviewed and approved in the app. Several drafts may exist, each against live; no merging; one is promoted, as a new version of live. An emergency fix is a draft promoted ahead of the others, which are kept, marked as behind live. Later: "Reconcile against drafts deployed since", carrying over changes in untouched areas and marking conflicts for manual resolution. Supersedes C4's one draft at a time. After the walk: whether a draft needs approval before promotion is an organization setting; local edits are never stored remotely until submitted as a draft. — Mark, 2026-10-21superseded c121 D4 and D5: one shared Policy Config draft that publishes whole; no named drafts, approval or promotion (L8 and L8b, parked in git at 0beb2f879 and 02bbfe261)
W.9
C5 + C6
Publish with a note, rollback by moving the deploy pointer (Tyler): is a running change log with a publish pointer the same thing as revisions here, and is rollback logged as its own event?
Drawn: Not in the lab yet. c116 M2 has the deploy panel and a revision list; rollback as "restore = a new changeset" is c116 D5, which the pointer replaces.
ruled Rollback moves the pointer (Tyler), replacing c116 D5's restore-as-a-changeset; the move is logged as its own event (who, when, note). Drafts made against the version rolled away from are marked "behind diverged branch · potentially breaking". — Mark, 2026-10-21
W.10
§5 "published but not yet in effect"
What shows while a published revision propagates, or is in effect on some endpoints and not others?
Drawn: Per policy, on the mode control: "Configured · 0 of 100 endpoints confirmed" until qdash confirms, then "Confirmed on 97 of 100"; findings on unreached devices stay "Open · pending" (D3).
ruled The version list shows how far each version has propagated (e.g. v14 live on 97 of 100 endpoints, 3 still on v13), beside the per-policy rollout on the mode control and pending findings as drawn. — Mark, 2026-10-21
W.11
A6 · Q10
Frameworks as the entry point: tracking OWASP brings its policies in at Observe, and the admin backs out through Off or exceptions. Is that the flow, and where is it drawn?
Drawn: Not drawn yet (L6b). The Compliance copy still activates a framework without touching policies.
open
S1
Finding detail
[finding] [investigate] [resolve] [reeval]P2 FoundationP4 for Applies via, Respond reach, Create exception
One finding read without its session. Evidence above the line and never edited; the lifecycle below it as append-only rows with actor, time and cause; the response on the side with what it would reach.
Where to look
What to look for
- The evidence block is sunken and marked immutable; the lifecycle is the organ. Do the two read as different kinds of thing?
- "Why it violates" is computed: the scope paths, the exceptions considered and "still a violation now". Is that the right amount of reasoning to show?
- Respond carries reach counts. Try Ignore on F-S04: blank reason → the warning → Confirm → Done / Create an exception. Then Create exception and watch "still a violation" flip.
- F-S01 is Open · pending: enforcement confirmed in the scope but not on its device (D3 per device).
Questions
S1.1
Does the c79 SLA clock line return to Finding detail?
Drawn: Not drawn here; it stays on the Findings list. · options: keep off S1 / show in the band / show in the lifecycle header
open
S1.2
Related findings: shown by default or on demand?
Drawn: Shown by default, five rows, "showing 5 of N" when more.
open
S1.3
Are Ignore and Create exception available on the page, or only in sheets?
Drawn: Both on the page: Resolve ▾ in the header and the Respond aside; the capture opens inline.
open
S1.4
What belongs above the fold: the band shows status, severity, policy, applies via, enforcement for this subject, detected. Anything missing or surplus?
Drawn: Six cells.
open
S2
Findings
[findings] [investigate] [reeval]P2 Foundation
The live listing's pieces where they fit the model: cards, filter bar, group rows with their expand, member rows, the adjudication card. Open and Resolved are independent toggles; Grouped ⇄ Individual; the group header links to the policy; the finding id links to S1.
Where to look
What to look for
- Open on by default; toggle Resolved and the Vanta policy returns with its two enforced findings.
- Expand the sanitization group: the policy section, then the members with the status column and the last-event cell. Adjudicate opens the card; Ignore acts.
- Groups with nothing under the filters disappear and the footer says how many.
- Individual view keeps the filters and adds a Policy column.
Questions
S2.1
Groups collapsed by default?
Drawn: Collapsed, as the live page.
open
S2.2
Do the SLA clock and the past-SLA card stay? No intent asks for them; none forbids them.
Drawn: Kept.
open
S2.3
Severity on the group row: highest open severity with the cells as the distribution?
Drawn: Highest open, cells as distribution. · options: as drawn / highest only / distribution only
open
S2.4
After Ignore from the list under the Open filter, the row leaves the view at once. Keep it visible until the page is left?
Drawn: Leaves at once (the Done message goes with it).
open
S3
Policy detail
[policy] [severity] [scope] [enforce] G1 [catalog]P2 Definition · Severity · Findings · HistoryP3 Groups · FrameworksP4 Where it applies · Enforcement · Exceptions
Everything that hangs off a Policy, in its context, each section tagged with its delivery phase. The layer shell's header kept; severity as the recommended / configured pair; scope as paths with specificity; enforcement per scope with reach; exceptions; groups; frameworks; findings; history. The change sheet previews before it applies.
Where to look
What to look for
- Set the severity, then Reset: the pair and the History row.
- Where it applies: the paths, the overlap callouts (Priya through two paths, no conflict), the per-person probe.
- Add scope → the sheet: population, broadens or narrows, duplicate paths, conflicts, findings that would re-evaluate, the audit line. Apply, then find the row in History.
- Enforcement: Enforce on Engineering → the observe-first line (open findings, exceptions in scope). Add exception → the resource picker and the preview.
Questions
S3.1
Is there a policy-level on/off at all? Here State is derived: Active when any assignment reaches someone, Not in scope otherwise.
Drawn: Derived, no switch. · options: derived only / a switch that disables evaluation everywhere / both
open
S3.2
Eleven sections on one page with jump pills, or tabs?
Drawn: One page, jump pills.
open
S3.3
The change sheet as a side panel or inline under the section?
Drawn: Side panel.
open
S3.4
The layer PolicyConfigShell needs an exceptions slot (and the severity pair) to be seated as a component. Do that in the layer now, or at port time?
Drawn: Header copied into the page; a chip for the layer change is open.
open
S3.5
Should the Findings block show a severity distribution or trends, or does that belong on S2 and Reports?
Drawn: Counts, highest open, pending count, four sample rows.
open
S3.6
Per-policy configuration (G7, from the qdash policy listing's expand rows): is a global entry on an allow list the same thing as an organization-wide exception? Should configuration be per scope, like severity is expected to become? And should an edit preview before it applies, or apply at once as in qdash?
Drawn: A Configuration section after Definition (added 2026-10-18 at Mark's ask). It seats the layer editors by shape: list, detectors, level or threshold. "Seen, not on the list" comes from the policy's findings. Edits apply at once, add a History row and re-evaluate (D2): a global list entry or a switched-off detector resolves matching open findings as Policy changed.
open
S4
Policies & Frameworks
[catalog] [severity] [groups] [framework]P2 Policies viewP3 Frameworks · Groups views
One area, three lists on the ink switch. Policies keeps the Control Center rows with an Applies column in place of the activation toggle; Frameworks is one list with Tracked and derived coverage; Groups is the S7 list. The framework strip that activated policies is gone.
Where to look
What to look for
- The Applies column: organization-wide · N groups · Not in scope, with the enforcement summary beneath. Does it replace the toggle well?
- Reset on the Vanta policy's row. Group by Policy Group, then "Not in any group".
- Frameworks: Track on ISO. The coverage counts beside it.
- Groups: the draft and the retired group in the same list, with state.
Questions
S4.1
Groups as a third view in this area, or its own rail item?
Drawn: Third view; the rail stays Findings · Policies & Frameworks.
open
S4.2
Is Tracked the answer to framework activation? It changes no policy.
Drawn: Tracked as a declaration.
open
S4.3
Does a policy row need an expand at all now that configuration lives on S3?
Drawn: No expand; the row links to S3.
open
S4.4
The rail order: Findings first (the journey starts in Observe), or Policies first as today?
Drawn: Findings first, proposed in the surface map.
open
S5
Framework detail
[framework] [catalog]P3 Organization
The earlier framework page as the starting point: its title row, table shape, all ten OWASP risks with their fit notes, and its satisfying controls, now catalog policies. The new phase takes precedence where they differ: Track instead of Activate, coverage derived, capability · configuration · findings as three cells, gap reasons, the Gaps list never hidden.
Where to look
What to look for
- Each risk: the derived state, the earlier page's note beneath it, the mapped policies in three cells, the gap reason.
- Where the old page said "out of scope" but listed controls, the derived state reads partially and the note says why.
- SOC 2: every criterion a gap, every gap listed. ISO overflow: filter by coverage.
- The summary band and the "What coverage means" disclosure.
Questions
S5.1
Risks the old page called out of scope but that have helping controls: partially addressable (derived) or not addressable (the old dot)?
Drawn: Partially, with the note.
open
S5.2
Is the three-cell policy row (capability · configuration · findings) too dense for the table?
Drawn: Three cells per mapped policy.
open
S5.3
Should the Gaps list also include partially covered requirements?
Drawn: Only not-addressable ones.
open
S5.4
Coverage as counts, never a percentage?
Drawn: Counts.
open
S6
Scope & enforcement change
[scope] [enforce] [reeval] [groups]Lives inside the change sheet on Policy detail and Policy Group.
P4 Applicability & Enforcement
One flow for both, because the preview is the same: choose → preview (population, broadens or narrows, duplicate paths, conflicts, findings that resolve / reopen / resolve as Enforced, observe-first) → apply with the audit line. S8b reuses the preview.
Where to look
What to look for
- A conflict blocks Apply; a duplicate path only warns.
- The observe-first line before enabling enforcement: open findings and exceptions in that scope.
- The audit line is the History row it will add.
Questions
S6.1
One flow for scope and enforcement changes, or two?
Drawn: One sheet, modes.
open
S6.2
Equal-specificity conflicts: block Apply (drawn), warn, or prevent at save?
Drawn: Block until resolved.
ruled Moot under D9: ties go to the stricter setting, so there is no conflict to block on — the sheet previews which way a tie goes. — Mark, 2026-10-18
S6.3
Should enabling enforcement require an observation period, or only show the observe-first counts?
Drawn: Shows the counts; never blocks.
open
S7
Policy Group
[groups] [scope] [enforce]P3 membership · stateP4 scope · overlaps
Populations, not duplication. References never copies, with "also in"; overlaps named with shared policies and conflicts; the probe shows a person's policies through this group in bold; the change sheet reused for scope, membership, state and duplicate.
Where to look
What to look for
- Add policies, then the History row. Duplicate: the copy opens as a draft. Activate it.
- Overlaps: the baseline shares Priya and three policies, one enforcement conflict named.
- The retired pilot is read-only and keeps its history.
Questions
S7.1
Does Duplicate copy the scope (it asks for one) or membership only?
Drawn: Asks for a scope; the copy starts as a draft.
open
S7.2
May a group carry several scopes, or one?
Drawn: One.
open
S7.3
Retire only, or Disable as a reversible middle state too?
Drawn: Draft → active → retired; disabled exists in the model, not in the verbs.
open
S8
Resolve with Ignore · Create exception
[ignore] [resolve] [investigate] G1Lives inside Finding detail and the Findings adjudication card (Ignore); Finding detail and Policy detail (Create exception).
P2 IgnoreP4 Create exception
The decided flow from the Ignore intent: reason optional with the warning and Don't ask again, duration required, then Done / Create an exception. The exception builder, the missing intent drafted: resource, scope with specificity, reason, duration, the preview.
Where to look
What to look for
- Leave the reason blank: the warning with Confirm · Cancel · Don't ask again. Confirm, then the organ row.
- Create an exception from Done: the preview says how many findings would resolve as Allowed and whether enforcement is active in that scope.
Questions
S8.1
Is Don't ask again a per-practitioner preference only, or eventually admin-configurable?
Drawn: Per practitioner.
open
S8.2
The exception builder: inline where it was started (drawn) or navigate to the policy?
Drawn: Inline, in the aside or the sheet.
open
S8.3
When a time-bound Ignore expires: straight back to Open, or re-evaluated first?
Drawn: Back to Open, then re-evaluated in the same pass (D2).
open
S8.4
The intents name the Exceptions intent as missing (G1). Draft it from S3 and S8b as drawn, and send it to Mark Peterson?
Drawn: Drawn; not yet written as an intent.
open
X
Cross-cutting
the phasing and the model, outside any one surfaceX.1
Mark Peterson's delivery phase 2 says policies apply organisation-wide with no scopes. Does any enforcement ship in phase 2? If so, D3 and Resolved: Enforced ship with it.
Drawn: Every surface tags its sections by delivery phase; S1, S2 and the P2 parts of S3 and S4 stand alone.
open
X.2
Phase numbering: his phases 1–4 are delivery; ours are plan phases 0–6 and the design site's Phase 4. Call his "delivery phases" everywhere?
Drawn: The mocks say "delivery phase N".
open
X.3
He maps 11 intents; we have 14 plus the missing Exceptions one. Send him the surface map's matrix as the full mapping?
Drawn: The matrix exists in surface-map.md and on the wireframes page.
open
X.4
The fixture's open sanitization findings are pending because enforcement has not reached their devices. Is per-device reach the right reading of D3?
Drawn: Per device, with the pending devices named on the enforcement entry.
open
After the walk
- Rulings go into CYCLE.md Decisions with a date and into this page's data, so the mocks and the record agree.
- Feedback to qpoint-io/intents as a pull request: the Exceptions intent drafted from S3 and S8b (G1), the two overlaps merged (G2, G3), the vocabulary normalised (G4), the open questions the mocks answered (G6), and the fourteen-intent matrix against the delivery phases.
- Phase 5: layer extractions (the lifecycle organ, the severity pair, the coverage state, the scope path row, the change preview panel), the qdash port on feat/new-pages, and the backend gap list for Tyler, each item tied to its intent line and its delivery phase.