13
The go-live gate
No agent touches regulated work until six cells are solid. The version that gets bought, because it converts a framework into a control a second line of defense can enforce.
- In the room
- Risk, the deploying team, and whoever signs
- Time
- 30 minutes per deployment
- Output
- A pass, a conditional pass with a date, or a stop
- Fails when
- It becomes a form. Gates that are never failed are not gates
Cells: Authority, Composition, Flow, Evidence, Mastery, Incentives
14
Audit and framework mapping
Map the Evidence cell once to the regimes you live under, then reuse it. The overlapping frameworks ask similar questions in different vocabularies.
- In the room
- Compliance, plus the engineer who has to produce the artifacts
- Time
- Two to three days once, then maintenance
- Output
- One control set, several framework mappings
- Fails when
- You map to the frameworks and never test whether the system can actually produce the evidence unprompted
Cells: Evidence, Authority, Mastery
15
Role design and credentialing
Each cell already names a capability. Turn the twelve into assessed roles and you have the credential nobody currently issues.
- In the room
- Capability lead, assessors, a regulator-facing reviewer
- Time
- A program, not a session
- Output
- Assessed roles rather than attended training
- Fails when
- It becomes a course with a certificate instead of a simulation with a pass mark
Cells: Mastery, Authority, Evidence
16
Quarterly instrument panel
One indicator and one threshold per cell, reviewed on a cadence. Cycle time for Flow, override rates for Authority, evidence completeness for Evidence.
- In the room
- Operating model owner, quarterly
- Time
- One hour a quarter
- Output
- Twelve trends and one cell to work on next
- Fails when
- Indicators get chosen because they are easy to collect rather than because they would change a decision
Cells: All twelve