The operating model: a standing organization, not an event.
The joint version ladder, how a capability earns its way from replay to bounded execution, the strict definitions of bounded autonomy, and the assumptions, non-claims and falsifiers that travel.
The KTP mechanism
Governance in motion: standing is recomputed at every act, inside nested zones.
KTP never settles authorization once. Every consequential action is checked against the environment at the moment it is attempted, and the zones an agent runs in set the ceiling (see Blue Zones). An operating model built on that has to be versioned the same way: a joint version names what the organization has proved it can hold, and a vendor release is never a version.
The working form, from the workbook
The workbook names four joint versions, V1 to V4 and a Horizon, each with the question it answers and the proof it needs; a promotion ladder that every capability climbs (replay, shadow, recommend, bounded execute); and the exit each version must show before the next opens. Its strict definitions say what bounded autonomy is and is not allowed to mean.
V5: No. A SIEM release is a platform train, not Version 5.
The promotion ladder · what every capability climbs, and can lose
Stage 1 of 4
Replay
Analyze historical or synthetic cases; draft detections/playbooks.
evidence Reproducible scenario; expected vs actual; owner review.
Stage 2 of 4
Shadow
Analyze live data; queue a recommendation; change nothing in operations.
evidence Comparison with analyst outcome; confidence and error review.
Stage 3 of 4
Recommend
Present an evidence-backed action for human approval.
evidence Policy decision, rationale, consequence, approval, case record. Citation record: join keys and observation class of every case object relied on (ASM-35). Attacker-authored or unverified sources are flagged.
Stage 4 of 4
Bounded execute
Pre-approved low-consequence class only, with scoped credentials and rate limits.
evidence Precondition, action audit, independent verification, rollback, revocation path; acceptance record pins the drafter, the model identifier, and the system-prompt hash (ASM-37).
Any stage: A model or prompt change behind a promoted class drops it to shadow until regression passes (ASM-37). In KTP's terms, standing is earned through trajectory and can be lost; a stage is never a credential.
Acequia, Inc. is an invented organization. These pages present a working design, not deployment results; its contracted stages and change freezes are illustrative. The sections below mirror the Governed Autonomy workbook (v0.50): its columns, rules, invariants and catalogs, as written, with the worked example's organization named as it is there. The deployment's own rows, parties, contract identifiers and configuration stay with the deployment; where a table's rows stay, its columns are shown.
Acequia is a standing organization, not an event. The estate runs every day: services, networks, applications, and the people who depend on them. The work does not close. The threat does not reset. What is shifting is the operating model. Artificial intelligence now drafts, correlates, and proposes faster than a person can approve each action. Automate everything, and an unseen process becomes theater. Put a person on every finding, and the organization cannot be covered. Governed Autonomy is that shift, at enterprise and public-institution scale. Data Analytics Provider provides the platform. Operating Provider holds operating authority and acceptance. One case. A named person accepts each class of work, can stop it, and owns residual risk. A machine earns the right to act. This workbook records that way of working. It is not a license and not a grant of autonomy.
02Missionworkbook tab 01 · Exec Overview
Acequia owns the mission as a going operation — a business or a large public institution, under the same constraint. Operations accumulate. New services, new identities, new paths, and new AI-assisted work land on the estate that already exists. There is no peak window after which the duty ends.
Data Analytics Provider provides the platform. Operating Provider holds operating authority and acceptance. The mandate is one case across security, network, and application observation, joined by end-user experience. That case has to remain true as the organization evolves. A later platform train is not a new mission.
032. Joint version ladderworkbook tab 03 · Review
Each version is a question the organization must be able to answer with evidence, not a product release.
Can supervised agents act with register, scope, verify, revoke?
Status in this program · Joint contracted path after V2 exit
What proof looks like
The joint version names the program floor. Bundles promote on their own lines: a playbook can be at V3 while a playbook is still at V1. Replay to bounded execute per action class; acting != verifying. A handful of classes reach V3 before the change freeze.
Is evidence connected and fit enough that a machine could assist?
What we build
the common data model (or equivalent); service catalog + acceptance matrix; source/data contracts; reference-data hierarchy; six-party join objects (Cyber Security, IT Operations, Application Operations, Governance, Regulatory, Compliance); context catalogue first wave (entity graph, evidence fitness, mission schedule); world stubs declared; legacy SIEM and off-path data analytics off the production path.
Operating truth
Shared semantics across SOC, NOC, app, and GRC. Conflicts visible. One case spine across playbook handoffs.
Option this preserves
Environment signals exist and are linked — later autonomy limits have something to read.
Can live operating context reduce or deny an otherwise authorized action?
What we build
Session lineage, declared purpose/scope, ARQ on the shared case, owned uncertainty, independent verify, working revoke. No new case spine.
Operating truth
A valid credential and an in-register action class are not enough if service consequence, schedule, evidence fitness, or unresolved uncertainty says no.
Option this preserves
Network Platform Provider and Operating Provider share this as the next maturity after V3 is proven — not a new SIEM contract line by itself.
Name the stack. Name the missing join. Freeze vocabulary. Do not start agents on tribal knowledge.
Build / current truth
Workbook + corpus + six playbooks inventoried. Dual-stack (legacy SIEM / off-path data analytics) still in source playbooks. Spreadsheet inventories. No delivered service catalog. Seven context domains named as slots, not populated.
Exit
Exit: this tab is agreed. Gaps are owned rows, not memory. No V3 work depends on an unnamed source of truth.
Human act
Humans: decide what is source of record; refuse silent dual-truth.
Connect evidence so a machine could assist without amplifying confusion.
Build / current truth
the common data model (or equivalent). Service catalog + acceptance matrix. Source/data contracts. Governed reference data. Context catalogue first wave: entity graph, evidence fitness, mission schedule. Weather/traffic/safety declared as stubs. Legacy SIEM and off-path data analytics off the production path.
Exit
Exit: host=service=venue=owner=journey is a lookup, not a hunt. mission schedule exists as derived state (). Empty weather is unknown, not no-risk. SOC/TOC share severity semantics. Replay/shadow candidates exist. Uncertainty backlog is visible.
Human act
Humans: resolve context conflicts; name where judgment is required; rehearse degraded-data cases.
Agent register (owner, purpose, tools, expiry, revoke). Purpose/scope on consequential cases. ARQ verify != actor. Promotion: replay -> shadow -> recommend -> bounded execute. Each action class sits on its own version line.
Exit
Exit: Network Platform Provider and Operating Provider can defend operating boundaries to Acequia. Autonomy can contract mid-session. Kill/revoke works. No tribal dependency for a V3 action class. A slipped does not freeze unrelated classes. Only a handful of classes reach V3 before the change freeze.
Human act
Humans: approve, interrupt, verify, accept/revoke autonomy, own consequence.
Live operating context can reduce or deny an action that is otherwise authorized.
Build / current truth
Same spine. Session lineage, purpose/scope, ARQ, owned uncertainty, independent verify, working revoke. No new platform.
Exit
Exit: Network Platform Provider and Operating Provider can show a case where green auth was narrowed or stopped because service consequence, schedule, evidence fitness, or unresolved uncertainty required it — and a human still owned the outcome. V4 / is a later horizon payoff, not the mission year deliverable.
Human act
Humans: set the context policy; judge whether a stop was correct; recover authority gradually, never because a KPI went green.
Horizon is V4 spoken as a shared target: keep operating under context-constrained agency.
Build / current truth
Not a fifth product. Not a new SIEM edition. Not V5. A new SIEM platform train is a platform train on the . Uses the V2 join and V3 session record or it is a re-platform.
Exit
Exit: both parties use the same words in the room. Horizon does not replace V1–V3 evidence. It consumes them. V4 is a later horizon payoff.
Human act
Humans remain the accountable center: values, exceptions, competing missions, and whether an agent may act at all.
065. Capability promotionworkbook tab 03 · Review
The ladder every capability climbs. In KTP terms: standing earned through trajectory, and a stage that can be lost.
Present an evidence-backed action for human approval.
Required evidence
Policy decision, rationale, consequence, approval, case record. Citation record: join keys and of every case object relied on (ASM-35). Attacker-authored or unverified sources are flagged.
Pre-approved low-consequence class only, with scoped credentials and rate limits.
Required evidence
Precondition, action audit, independent verification, rollback, revocation path; acceptance record pins the drafter, the model identifier, and the system-prompt hash (ASM-37).
Each priority SIEM requirement has an owner and evidence state; priority services and sources are visible; Operating Provider can receive, investigate, route, and close priority incidents through named runbooks.
Not sufficient
Dashboards, platform access, or a successful connector test alone.
Evidence fitness, service/identity/asset/venue/journey context, mission schedule as derived state (), IT Operations and Application Operations IDs bound to the security entity graph, GRC objects visible on case, shared cases, tested detections, governed data, structured/reversible playbooks, and operator oversight function together. World stubs declared. Empty weather is unknown, not no-risk. Legacy SIEM and off-path data analytics feathered off.
Network Platform Provider and Operating Provider can show live context narrowing or stopping an in-register action (ARQ, schedule, evidence fitness, or owned uncertainty) with a human still accountable.
Not sufficient
A new SKU name, a new SIEM tenant, or 'the environment' as a slogan.
Permission to act only inside an explicit declared action class, scope, risk, time, rate, and consequence limit, with a human still accountable for residual risk.
Required conditions
Named class; documented scope; scoped credential; rate limit; revoke that works in flight; independent verification; human interrupt.
Forbidden interpretation
A licensed agent, commercial edition, feature flag, or Data Analytics Provider representative enablement. Unbounded 'agency' or 'the platform acts'.
The promotion stage that may perform only a pre-approved low-consequence class, with scoped credentials and rate limits, after replay, shadow, and recommend.
The condition under which the machine must halt, degrade to recommend, or hand back rather than continue. Safe stop hands back to a human. It is not a decision to do nothing.
Required conditions
Unknown required context; failed verification; expired scope; rate-limit breach; human interrupt; failed join on a required key; named human when not acting is the higher-consequence choice.
Forbidden interpretation
Continuing because a KPI is still green. Treating emergency as an automatic widen. Treating a stop as permission to leave the harm in place.
Zeroth Law: an action's risk (A) must not exceed the trust the environment currently affords (E). Acequia's testable form, taken from the V4 wording: live context can only take authority away. It never adds authority.
Required conditions
Any declared context object may narrow or deny. The authority envelope under high-trust context is never larger than the no-context baseline.
Forbidden interpretation
Treating A ≤ E as a slogan. Letting a high E, a green KPI, or a populated context slot widen a class, scope, credential, rate, or promotion stage.
An observation a work type emits that another refusal point reads as context. It sets E for the classes that read it; it never widens A.
Required conditions
Authenticated source; measurement envelope (subject, population, window); outlier detection; at least one causally independent channel per dimension; reads a source the did not produce.
Forbidden interpretation
An evidence_only ceiling read as zero consequence. A dashboard the executor computed read as independent verification.
Authority / source
§6; catalog §3; TM-S-003; ASM-34 / FAL-35
09Ranked assumptions that travelworkbook tab 04 · Claims & boundaries
The assumptions that are about the model rather than one deployment. Each names what happens if it is false.
Human-gated means the class, not the action. A named person accepts, interrupts, verifies, and owns residual risk. Approving each action (HITL) is not the control.
Scope / size
Program
Criticality
Critical
If false
Per-action approval becomes the gate. Analysts fatigue, and the human gate turns ceremonial.
Unavailable, empty, or missing context is unknown, not zero. Evidence is never a verdict. Unknown must not authorize and must not score as no-risk. Required context is the set named on that class's record.
Scope / size
Cross-party
Criticality
Critical
If false
Empty weather, missing schedule, or stale source becomes a false all-clear.
Induced conservatism (an adversary manufacturing uncertainty so the system's tighten-only rules freeze legitimate action) is proposed as a named threat to . The workbook adopts the bound specifies. Until then, no interim bound is claimed here. Every narrowing records its cause: measured, undefined, disputed, or externally driven ( §6.7). Environment-caused narrowing recovers on a declared recovery tail per class, adopted from when it lands. Agent-caused narrowing returns only when a person accepts it again.
Scope / size
Cross-party
Criticality
High
If false
Fail-closed, unknown-is-not-zero, and the context veto are treated as free, and manufactured uncertainty is not named as attack surface.
The SIEM platform will hold a knowledge graph of security entities, findings, and detections. The join graph treats it as one source. It maps that graph's IDs onto join IDs. The join graph owns identity across all six seats.
Scope / size
Cross-party
Criticality
High
If false
A join node exists only through a product ID, and a product change rewrites identity on the shared case.
Two or more organizations' graphs connect through the Join, never directly. Each source graph publishes a profile. Each connection has a declared interface. The Join holds identity and precedence.
Scope / size
Cross-party
Criticality
High
If false
Two graphs exchange facts point to point, and no party can say whose claim holds on the shared case.
The join graph treats its inputs as a supply chain. Every profile, interface, crosswalk, and rule records its producer, version, and content hash. An unsigned or revoked input does not constrain.
Scope / size
Cross-party
Criticality
High
If false
A changed or compromised input reaches a Case unseen, and no party can say which Cases relied on it.
A Join can sit inside a larger Join. The child keeps its own IDs, and the parent refers to them by qualified ID. Unknown, expiry, and revocation pass upward unchanged.
Scope / size
Cross-party
Criticality
High
If false
A parent rewrites a child Join's IDs, or a fact from a revoked child still constrains at the parent.
Joins owned by different organizations connect as peers. Neither one owns the other's identity. A peer identity match constrains only when both sides assert it, and nothing transits from one peer to another.
Scope / size
Cross-party
Criticality
High
If false
One organization's Join decides identity for another's, or a fact from one peer reaches a third organization unagreed.
Every work item traces to the Mission: work item, work type, capability, objective, Mission. The line is derived from those edges and never asserted by hand.
Scope / size
Cross-party
Criticality
High
If false
Work goes on that serves no objective, or an objective has no work behind it, and no party can see either.
One identity spans IT and the Business. A department, an IT group and the Case Join use one join ID for the same service, venue or work item. A cross-tier handoff carries identity instead of re-keying it.
Scope / size
Cross-party
Criticality
High
If false
Each tier re-keys the same object at every handoff, and the cost of the Join's absence returns at the business boundary.
Context is monotone toward less authority. Any context object can narrow or deny an otherwise authorized action. None can widen class, scope, credential, rate, or promotion stage. This is Acequia's testable form of .
Scope / size
Action
Criticality
Critical
If false
A high-trust or high-E context object is treated as permission to widen a class, scope, credential, rate, or stage.
103. What this is not / what this does not doworkbook tab 04 · Claims & boundaries
That IMP replaces the join, or that TechnologyTOC is mission all-management.
Why this boundary exists
IMP consumes Stage 3 Join. TechnologyTOC remains venue and critical-situation technical authority. BroadcastTOC is Media Provider and is not TechnologyTOC.
Observe public-safety networks, do not control them
That ingesting CAD, public-safety broadband network, or public-safety radio telemetry authorizes dispatch, radio control, or a seventh operating party.
Why this boundary exists
may incorporate public-safety signals to detect degradation that threatens mission operations. Control stays with the public-safety authority. law enforcement / national-security event designation is consume/handoff on the same case.
KTP class letters are not Acequia evidence classes
That KTP-CLASS:D/N/S/A/P (Determined, Narrative, Subjective, Agentic, Policy) means the same thing as Acequia evidence classes //// (Direct, Enumerated, Adjudicated, Published, Derived state).
Why this boundary exists
KTP keeps its native letters. Acequia evidence classes use three-letter codes. One meaning layer does not share two letter maps.
That unknown-is-not-zero, fail-closed, and the context veto are costless safety properties.
Why this boundary exists
Those rules are themselves attack surface: an adversary who can manufacture uncertainty can freeze legitimate action. Induced conservatism is proposed as a named threat to . Until that bound lands, recovery of a class is split by cause (ASM-25).
Undefined, disputed, or externally driven narrowings exceed the declared share for a class in a window. Or an environment-caused narrowing waits on human acceptance.
Failure threshold
Any class whose non-measured narrowing share exceeds the joint threshold, or any environment-caused narrowing without a declared recovery tail.
Required evidence
Register cause column per narrowing; recovery tail per class; conservatism attribution when it lands.
Perkins, C. (2026). The operating model: a standing organization, not an event. Kinetic Trust Protocol. https://kinetic-trust-protocol.net/governed-autonomy/operating-model
Plain text
Chris Perkins, "The operating model: a standing organization, not an event," Kinetic Trust Protocol, https://kinetic-trust-protocol.net/governed-autonomy/operating-model.
Page created 28 October 2026 · last modified 2026-10-27
