Human authority / release boundaries
Automation prepares evidence. People make the consequential decisions.
This map names the human checks in the current system. They are gates, not employees or claims of continuous staffing. A role is satisfied only by an authenticated person who is permitted to make that decision and has inspected the relevant evidence.
No independent reviewer, external sandbox response, monitored pilot or internal result witness is recorded. The €20k+ autonomous delivery capability remains a development target.
1 · Before invoicing
Operator verifies the commercial order
The operator checks accepted scope, exclusions, capacity, seller and buyer details, applicable VAT treatment, terms, delivery date and the invoice preview in their authoritative systems. The browser order gate records no data and cannot substitute for those checks. A forecast, invoice or test payment is not income.
2 · Before the monitored pilot
Independent reviewer accepts responsibility and approves the fixed scope
A separate signed-in person must claim the one-hour reviewer invitation. That reviewer may approve only the fixed internal reference-pilot scope. Enrollment is not approval; scope approval is not final QA; neither is customer acceptance.
3 · At review-ready state
Independent reviewer records final QA
Final QA opens only after the authorized workflow reaches ready_for_review. The reviewer inspects the stored pilot metrics and controlled evidence reference, can download the redacted manifest and validate its structure locally, records open material findings, and may pass only when none remain. The append-only review and workflow transition are stored atomically. Validation is not approval.
4 · After seven measured days
Separate result witness confirms the internal outcome
A third signed-in identity—different from operator and reviewer—may receive a one-hour acceptance handoff only after the full seven-day pilot, explicit operating-cost evidence and clean QA. This witnesses an internal result. It is not customer acceptance, revenue, delivery or uptime proof.
5 · For client delivery
Authorized client accepts consequential outputs
Client-specific scope, sensitive-data handling, binding terms and final acceptance stay with authorized people. The system may prepare drafts and evidence, but it cannot infer approval, sign a binding agreement, promise capacity or declare delivery complete.
Open handoffs
What is needed next
- Enroll one real reviewer through the protected one-hour handoff.
- Run one challenge-bound probe from an authorized external sandbox.
- Prepare and execute the fixed internal pilot for at least seven measured days.
- Resolve all material QA findings and record operating cost.
- Use a third identity to witness the completed internal result.
Generated, self-approved or backfilled records do not satisfy these gates.