L0 · Policy & Risk Register
Lowering a ceiling without a deployment
Rule R3 says the autonomy ceiling is data, not code, so Legal can ratchet a ceiling down without waiting for a deployment. This surface tests that, and shows the three places the same design works against the organization.
ACTIVE HOLDS
4
MIN TO RATCHET DOWN
2.2
MARKETS ASSESSED
22 / 114
CONTROL WATCH
2 of 3 tripped
The architectural rule this page tests
The autonomy ceiling is data, not code.
Legal must be able to ratchet down a ceiling at 23:00 on a Friday without a deployment. Every control on this page is downstream of it.
“Ceilings ratchet DOWN instantly, on any named individual’s authority. They ratchet UP only at the governance cycle, with evidence.”
Supports · Asymmetric by design. The asymmetry is the safety property — and, measured over a year, the biggest single constraint on how far autonomy ever gets.
The register that holds it
One store, jointly owned by Legal and Comms, written only by humans, read by every agent before it acts. 8 rule types, reviewed on a 91-day cycle.
The clause that bites later
A ceiling without a rationale cannot be lifted, because nobody knows what would justify lifting it.
2 of 11 ceilings in the illustrative register carry no recorded rationale. Under this rule they are not strict — they are permanent.
The control plane
One control, three exposures
A ceiling drops in minutes, on one person's authority, with no deployment. Raising one takes a governance cycle, and most of the operating estate has no recorded legal basis.
Minutes to ratchet down
0.0
11 downward changes · 0 deployments
Days to ratchet up
0.0
Oldest sponsored request has waited 134 days
Countries assessed
0
of 114 operating · 92 with no recorded basis
Discoverable records · year
0.0K
2,002 in the two classes a plaintiff asks for first
One of these four numbers is a control. Three are exposures.
The first number is the one the rule promises, and it holds: across 11 downward changes the mean time from decision to enforcement is 2.2 minutes, 5 of them outside working hours, none of them requiring a release. The other three are the bill for that design. Raising a ceiling takes a mean of 68.4 days against a 91-day cycle, and 2 of the 5 sponsored, evidenced requests in the queue are already past a full cycle. The permission matrix covers 22 markets holding 80.8% of restaurants, which leaves 92 operating countries where the platform has no recorded legal basis and therefore does not know that it is not allowed to listen. And the record that makes all of this auditable runs to 12,691 entries a year, of which 15.8% sit in two classes that are very hard to read charitably out of context.
Mean 2.2 min to enforce a downward ceiling change, across 11 events, with 0 deployments
If this trips, the autonomy ceiling is code again, and Legal has lost the control.
Threshold · R3 holds only while a ceiling can drop without engineering involvement
Oldest sponsored up-ratchet has waited 134 days
Evidence-backed autonomy that never arrives is the same as a permanent ceiling. This is how a ratchet becomes a one-way valve.
Threshold · One governance cycle, 91 days
22 of 114 operating countries assessed
An unassessed market has no recorded legal basis. The platform does not know that it is not allowed to listen there.
Threshold · Every market with an active listening or publication path
Active holds
4
5 in the window, 1 lifted on determination
Artifacts frozen
154
120 drafts in flight and 34 already published
Mean time to freeze a draft
4.2 s
The scope test runs on the next agent invocation, not on a deployment
Mean time to recall published work
23.0 h
Worst case 31 h. People, not code.
The asymmetry to read first
A hold catches work in flight in about 4.2 seconds, because the scope test is a read against the Policy and Risk Register that happens before every agent invocation. It catches work already published in about 23.0 hours, because that path runs through human beings, regional teams and wire services. The gap is roughly 19,714 times. The control is not the hold. The control is getting the hold in before publication, which is an operating discipline, not a feature.
UK workplace conduct proceedings
Routes to
General Counsel
Freeze
4 s
Recall
19 h
Frozen
196 d
The register example carried in the specification. Every read of the register pre-checks against it.
Set by General Counsel · 2026-03-04 · review 2026-10-01
Joint-employer determination, three consolidated matters
Routes to
General Counsel
Freeze
3 s
Recall
31 h
Frozen
120 d
A0 rather than A1: no agent drafts on this topic at all. The scope reaches franchisee relations, crew scheduling language and anything describing operational control.
Set by General Counsel · 2026-05-19 · review 2026-11-15
EU supplier safety investigation
Routes to
Regional counsel, EMEA
Freeze
6 s
Recall
22 h
Frozen
106 d
Market-scoped, not topic-scoped, which is why the caught-draft count is lower and the propagation is slower: the scope test has to resolve a market list, not a topic tag.
Set by Chief Compliance Officer · 2026-06-02 · review 2026-12-01
Franchise economics class action, United States
Routes to
General Counsel
Freeze
3 s
Recall
26 h
Frozen
61 d
Set at 23:12 on a Friday, thirty-two minutes after the filing. See the ratchet ledger.
Set by General Counsel · 2026-07-17 · review 2027-01-15
Australian employment tribunal matter
Routes to
Regional counsel, APAC
Freeze
5 s
Recall
17 h
Frozen
110 d
Lifted after determination. Retention stayed frozen for the full 110 days the matter was live; rolling deletion in the Signal Lake resumed only on lift.
Set by Regional counsel, APAC · 2026-01-08 · review 2026-04-28
Recall protocol · specified, then measured
When an Evidence Ledger claim is retracted, the platform does not send an email. Four things happen in order, and each one is specified.
A claim moves to status: retracted in the Evidence Ledger.
3 retractions in the window
Every artifact in that claim’s used_in reverse index drops to A0.
47 artifacts touched
The Chief of Staff raises an immediate G2 across every affected draft.
38 drafts re-gated, median 41 min to clear
Published artifacts route to E1, the correction and clarification workflow.
9 published artifacts, mean 31 h to correction
Three retractions in the window touched 47 artifacts. The 38 drafts cleared in a median of 41 minutes. The 9 that had already published took a mean of 31 hours to correct. Same protocol, two very different clocks.
Where the register becomes a gate
G3 RISK is the only gate that blocks by doing nothing
Every other gate has a default that lets work continue on timeout. G3 blocks the release and cannot be delegated.
Hard blocks · 5
These are not scored, weighted or balanced against a deadline. If the pre-check matches any of them, no draft leaves the platform until a named holder clears it.
Default on timeout
Block release.
A hold is only a control if it reaches the drafting path before the draft does. Across the illustrative holds on this page, a new matter reaches every agent in a mean of 4.2 seconds and stops work that has not yet been published. Work that is already out takes a mean of 23 hours to route and retract — roughly 19,714 times longer.
Drafts caught
120
Already published
34
Jurisdictional constraint
Employee listening is off in nine markets
Employee and crew listening is off by default in works-council jurisdictions. In a codetermination market, monitoring the workforce without a negotiated agreement is an industrial relations event.
9 of the 22 assessed markets operate under works-council or codetermination regimes, covering 12,237 restaurants. Any product plan that promises a global view of crew sentiment is either wrong about those markets or has not read them yet.
What that does to the roadmap
It is not a bug to be fixed. Lifting it requires a negotiated agreement per market, on the council’s timetable rather than the program’s.
It changes what the numbers mean. Crew sentiment measured across the estate is measured across the markets where listening is permitted, and should be labelled that way everywhere it appears.
It is the cheapest thing to get wrong. A single unauthorized listening path in a codetermination market costs more in standing than the entire program saves in a year.