four reins · one product
Land Identity in Observe. Earn the disable.
The ladder runs per theater, per actuator class — never a global switch. You promote iam.disable_key and okta.expire_grant, not “PRAUS.” Capacity.scale_down on staging rides along. Each rung has a sign-off and a shadow score on the sample tape.
| Mode | Touches prod | What it does |
|---|---|---|
| Observe | No | Sees the plant, scores drift and risk, writes the tape. It touches nothing. Run a shadow week: would-have maneuvers against live state, replayed before anyone promotes. |
| Suggest | No | Proposes a specific maneuver card — actuator, target, expect, unwind, envelope verdict — and waits for a human. |
| Supervised | Yes, inside the envelope | Acts unless aborted inside a visible dead-man countdown. Silence is consent inside the bridle only — it never expands the envelope. |
| Autonomous | Yes, unattended | Acts and verifies unattended. Whisper-stop still works, always, and the change calendar still applies. |
what each rein earns
Observe
01 / 04Proves the sensing is right and the scoring is not noisy. The shadow tape is the review.
Suggest
02 / 04Proves the proposals are the moves your operators would have made.
Supervised
03 / 04Proves actuation and verification hold under real failure.
Autonomous
04 / 04The boring loops stop waking anyone.
the offer
- Who
- Head of Infra, CISO, the last senior on-call.
- Job
- Hold the org chart you meant — standing admin, unused keys, leftover grants — without a quarterly review as the only loop.
- Gain
- Minutes not hours, fewer war rooms, and a principal that is allowed to touch prod.
- Proof
- Observe → Suggest → Supervised → Autonomous, unwind on every actuation.
A whisper-stop always works. A human can take the wheel. They should not have to drive.
Commission Observe