9. Governance & Authority
Story moment
Authority becomes a product surface
The Action Queue is where true judgment is preserved: one decision, evidence attached, consequence visible, receipt returned.
Executive Summary
What this chapter establishes
Authority is delegated where routine gates hold and reserved where unbounded authority appears.
Over-reserving safe mutation keeps Zach as the bottleneck; under-reserving authority breaks trust.
ROM and Reserved semantics are constitutional doctrine; mechanical enforcement is still maturing.
Routine Operational Mutations proceed fail-closed; reserved decisions are persistent Action Queue items.
Mechanically attest ROM gates, separately confirm near the boundary, and surface reserved crossings once.
The governance model exists to let agents act for months without re-litigating decisions, escalating only the few things that genuinely require the human.
9.1 The load-bearing distinction: Routine Operational Mutation vs. Reserved
Section titled “9.1 The load-bearing distinction: Routine Operational Mutation vs. Reserved”The reserved boundary is unbounded authority, not mutation. A real-world mutation that satisfies all six gates — scoped · receipted · reviewable · reversible · fail-closed · within delegated authority — is a Routine Operational Mutation (ROM): it is the purpose of the platform and is delegated, not escalated. The test is conjunctive and fail-closed: if any one gate fails or is unproven, the action is Reserved. Blast radius, not target system, sets the class.
| Routine Operational Mutation — DELEGATED | Reserved — ESCALATES to Zach | |
|---|---|---|
| Examples | GitHub comments/branches/commits/PR creation; Hermes/GLoops/Ralph/Portfolio updates when all six gates hold | Production authority; authority widening (rung promotion / scope / Trusted Lane); irreversible production actions; customer-impacting execution; security-boundary changes; constitutional changes |
| Why | Mutation alone does not reserve; this is what the platform is for | Each is a case where a ROM gate cannot hold |
| Check | The Work Order attests each gate (mutation_class: routine); a separate-agent review confirms it near the boundary |
Recorded once as a persistent Action Queue item — not re-prompted each cycle |
9.2 Decision rights — one obvious owner per decision
Section titled “9.2 Decision rights — one obvious owner per decision”| Decision type | Owner |
|---|---|
| Roadmap/slice selection, priorities within a product | That product’s agents, under its doctrine |
| Architecture & naming within a product | That product’s agents |
| Promotion-readiness threshold values | GLoops agents — raising a bar is delegated; lowering one escalates |
| The boundary, the Capability API contract & wire design, shared vocabulary, which product owns a new concept | Portfolio Steward |
| Routine Operational Mutations (all six gates hold) | Delegated |
| Reserved boundary = unbounded authority | Zach (escalation) |
The Portfolio Steward is an Opus-level agent holding portfolio authority (or Zach). It both adjudicates portfolio/cross-boundary questions (by ADR) and generates the portfolio’s governed work as Work Orders — not prompts. It holds portfolio authority but no execution authority: it asks and authorizes; GLoops performs.
9.3 The Work Order — the organizational-execution primitive
Section titled “9.3 The Work Order — the organizational-execution primitive”A Work Order is a durable, governed, identified expression of delegated organizational intent: “this capability work should exist — here is why, where, under what authority, and how completion is judged.” It is immutable once issued; changes by supersession. It is not a prompt, a GitHub issue, an ExecutionRequest, a Capability, an ADR, or a Decision Brief.
Three distinct, never-confused records anchor trust at three altitudes:
| Receipt type | Records a decision about… | Owner |
|---|---|---|
| Receipt | An operational action (who decided, original/final action, reasoning, evidence, outcome) | GLoops |
| Decision Record | An executive decision (brief, perspectives, dissent, evidence, authority set) | Ralph |
| Portfolio Receipt | A stewardship decision (issue/escalate/withdraw/close a Work Order, move a grade) | Portfolio Steward |
Chapter closeout
Decision ledger
Key Decisions
- Reserved boundary equals unbounded authority, not mutation.
Open Questions
- Where should ROM gate evidence be displayed in the product?
Related Chapters
- Action Queue Flow
- Ch. 11 - Product Surfaces
- Source Map - ADR 0006