Governance you can feel

Every enterprise AI deck has the same slide. Oversight. Human in the loop. Full auditability. Then you ask to see it in the product, and you get a settings page, a permissions matrix, and a PDF. Governance that lives in a binder is not governance — it is an alibi. If a fleet of agents is doing consequential work in your name, control has to be something you feel: a surface you open every morning, a number you trust, a button that means what it says.

That is the bar we build to, and it is checkable from the home screen.

One honest number

Home opens with a sentence: good morning, six things need you. That number is the entire contract between you and the fleet. It counts everything genuinely waiting on a human — approvals agents filed, escalations they raised, decisions awaiting your signature, and work parked on desks until someone signs — and it is the same number everywhere it appears. The badge on the rail, the headline, the list beneath it: one shared count. If the badge says six, the page can show and resolve six.

Two kinds of items never appear, and the omissions are the point. Expired approvals leave the queue, because the resolver would refuse them anyway. And your own requests never show up as needing you — you cannot approve something you asked for, so listing it would be a lie. A queue you trust is a queue that never pads itself.

Substance above the button

Click into any approval and the card carries the substance of the act, not its category. An agent asking to pay a bill shows the amount and the payee, rendered above the approve button. The requester, the action class, the expiry — present, but subordinate. You are never asked to sign a raw action class blind.

Two rules behind that card are enforced at the database, not the UI. Requester and approver must differ. Expired means dead. Rules that live only in the interface are suggestions; these are constraints.

Where the gates come from

None of these stops is improvised. Every AI colleague operates inside a charter, and every charter carries a decision-rights ladder with three rungs: what this colleague may do autonomously, what it must escalate, and what is forbidden outright. The approval that lands in your queue is the middle rung doing its job — an agent hitting the edge of its mandate and stopping, by design, instead of guessing.

Charters are readable the way a colleague's role should be readable: open the dossier and the ladder is right there, in words. They are also governable — amending an AI colleague's charter is itself a recorded act, proposed and signed like any other consequential change. Authority in Cohort is not a config flag someone toggled once. It is a document with a history, and the queue you triage every morning is that document, enforced.

Holds, floors, and the shape of "no"

Approvals are half the story. The other half is the hold — work parked, in place, on the desk that owns it: a mail draft held by policy in a guarded mailbox, a pay run unsigned in Books, a deal waiting in Revenue, a bank-feed line that didn't clear the bar. The needs-you queue lists every hold and deep-links to its desk, because a hold is resolved where the work lives, with the work's full context around it — never from a generic approvals inbox.

What decides the routine from the consequential is a floor. In Books, the floor policy sets an amount and a confidence bar: matches and spends under the floor, with high confidence, clear automatically; anything above it waits for a human. There is a kill switch that pauses the desk's automation entirely. This is what scoped autonomy actually means — not a vibe about trustworthiness, but a number, on a policy, on a desk, that you can read and change. And every automated act below the floor still lands on the record.

The strongest form of the gate is the signature act. Six acts on the money desk — signing a pay run, lodging tax, scheduling a bill run, and their kin — complete only on cryptographic proof of a human decision. Approving one mints a single-use token bound to exactly that act: the action class, the subject row, the amounts. If anything about the act changed after you approved it, the binding fails closed and the work holds again. A bare member id is not proof. Nobody signs for you, including software claiming to be you.

The spine underneath

All of it — every approval decided, every hold released, every floor cleared, every signature spent — chains onto one append-only, hash-chained audit spine. Not a log per feature: one spine, browsable by family, with an org action log that reads as plain sentences. Approving a request chains an approval.approved event; if the approval was gating a board task, deciding it moves the task too, and that move is on the record with it.

The spine is not a compliance export you generate for auditors once a year. It is a surface you read daily — the live activity rail on Home is the same record, humanized, scrolling past as the org works. History as a first-class surface changes behaviour upstream of any audit: agents act differently when every act is attributable, and so, frankly, do people.

Why "feel" is the right word

There is a hard-nosed argument under the soft word. Control that is felt gets used; control that is filed decays. An approval queue that pads itself gets rubber-stamped within a month, and rubber-stamped oversight is worse than none — it launders autonomy as diligence. So the discipline runs the other way: keep the number honest, keep the substance above the button, make yes fast and no real, and route the routine around humans entirely so that what reaches you deserves you.

The demo we give people is short. Open Home. Read the number. Open a card, and see the amount and the payee sitting above the button. Decide, and watch the receipt land on the spine. That is the whole thesis in one screen: not governance as a promise about the product — governance as the product.