Magnus Hedemarkandfactory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
a315b77bd8
Re-point relative references inside the six non-tailscale/workflow-architect
bundle dirs now that they live one level shallower at the repo root:
- bundle-root SKILL.md/manifest.yaml/README.md: ../../<target> -> ../<target>,
cross-bundle ../../bundles/<x> -> ../<x>
- forward-deployed-engineering references/: ../../../<target> -> ../../<target>
- product-lifecycle references cross-bundle ../../bundles/neckbeard -> ../../neckbeard
- product-lifecycle references/discovery-brief.md prose headings drop bundles/ prefix
- neckbeard eval shell commands bundles/neckbeard/eval -> neckbeard/eval
- production-excellence AGENTS.md depth note updated
- manifest header comments point at ../schemas/bundle-manifest-v1.schema.json
- regenerate docs/lifecycle-capability-matrix.{md,json}
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
2.0 KiB
Authority and Escalation
Before constrained action
Record the access route, identity and privilege needed, approved egress, systems and data in scope, change window, reviewer, rollback or recovery path, external-boundary verification, and evidence that the action succeeded. Load remote-systems-administration for its operational method rather than inventing one here.
Authority table
| Decision | Proceed only when | Escalate to |
|---|---|---|
| Scope, sequence, and thin slice | Charter names accountable lead and sponsor | Engagement sponsor |
| Access and privilege | Authorized identity, least privilege, and route are recorded | System owner or security owner |
| Security boundary | Trust boundary, threat assumptions, and controls are reviewed | Security owner |
| Privacy and data use | Purpose, classification, access, retention, and deletion are explicit | Privacy/data owner |
| Irreversible change | Recovery is tested or an authorized exception is recorded | Service or change owner |
| Material cost or quota | Budget owner accepts estimate and guardrail | Budget owner |
| External commitment | Contract, customer, or public promise is authorized | Business owner |
| Business priority or portfolio choice | Product or executive authority decides | Product/business owner |
When authority or evidence is missing, stop the action, record the blocker, preserve safe read-only discovery, and escalate with the smallest decision needed. Do not use urgency, stakeholder enthusiasm, or a working demo as an authority substitute.
Applied AI release boundary
An applied-AI demo is not production-ready without a representative baseline, adversarial or failure cases, risk constraints, evaluation results, an owner for residual risk, rollout and rollback evidence, and an explicit release decision. Route evaluation details to agent-evals-and-observability and readiness details to production-readiness.