How governance works

The rule everything else serves

A fact is visible to you if you can see at least one of the episodes it came from. That is the whole engine. Everything below only changes which episodes you can see.

It is a union, not an intersection, on purpose: a benign fact learned from both a public Slack thread and a private email stays readable, because suppressing it would punish the fact for the company of one of its sources. The reverse — a fact only a private source witnesses — stays private.

Four judgements, made once, at ingest

They compose rather than override. Sensitivity and groups are ANDed into one SQL predicate and its pure mirror, so a marketing member cannot reach a finance-sourced fact, and no member reaches a confidential one — while roles decide what can be changed and identity decides who the reader is in the first place.

Why classification needs no training on your company

Three cheap mechanisms stand in for a model that knows your business. The source sets a floor a classifier can never go under — a private capture cannot come out public. A narrow rubric then judges the content within that floor. And anything that would widen access waits for a person.

Group tagging follows the content, not the pipe

One Notion workspace holding both Finance and Marketing pages tags each page with the department that page is about. The connector's own mapping is only the fallback, used when the text does not say. The fallback never widens: “none”, an unrecognised answer, and any provider failure all fall through to the source's group, so a grouped source never quietly becomes ungrouped.

A workspace with zero groups skips the call entirely and behaves exactly as it did before groups existed.

What cannot be placed becomes a queue

Material that neither the content nor the source can place lands ungrouped, which the whole workspace can read. That is deliberately uncomfortable — it is a queue, not a resting state.

The Governance screen at /app/admin/governance shows an admin the count of what is currently that wide and files each item in one click. It also carries the classification report — what every connected source is visible to, derived by probing the real access predicate rather than restating the rules in prose, so the screen cannot drift from what the engine enforces.

Those human allocations are the training signal: they come back as worked examples in the next classification, so Flipper learns that #launch-eu is go-to-market and the board pack is leadership without anyone writing a rule. It never learns from its own past answers, which would let one early mistake harden into a house rule.

Rules that never bend

• The server is the boundary. The UI hiding a control is a convenience. Every route re-checks the caller's role, including calls made with an agent token.

• Out of scope means invisible, not forbidden. A fact you cannot see is returned as missing, never as “access denied” — the denial itself would leak that the fact exists.

• A missing setting is the restrictive setting. Policy resolves once per viewer, and an absent field reads as the guarded default, so a forgotten value under-shares rather than over-shares.

• Widening is audited. Every sensitivity change, policy flip, group allocation and merge is written to the audit log, which is append-only.

• Admins are not group-scoped. Groups narrow what members see. They are not a way to keep material from an owner or admin.

The one place approval, not filtering, is the gate

Playbooks are the exception worth knowing. An approved playbook is readable by every member, whatever the sensitivity of the facts it was distilled from — approval is the gate, not the access filter. To stop confidential material reaching a playbook in the first place, candidates are fenced at the source: only public facts witnessed by at least one public episode are eligible for distillation. Group-scoped facts are deliberately kept, on the view that departmental practice is not a secret.