Configurator, executor, verifier, acceptor; the separation rules; the role slots for the 216 published work types; and the accepted-autonomy register that says which classes of work a named person has accepted.
The KTP mechanism
The per-decision credential: a machine holds authority for one decision at a time, and never for a class of work on its own.
KTP-CORE §7 and KTP-ENFORCE §3 issue authority per decision and witness it elsewhere. The workforce model puts people on the other side of that: a human configures and verifies; a machine executes; a named acceptor owns a class of work, can stop it, and carries what remains. A change to the model or its prompt drops the class back to shadow until it is accepted again.
The working form, from the workbook
Human workers and machine workers are separate categories; a machine holds the executor slot only, with a human operator and verifier. Eleven separation rules. Role slots for the 216 published work types of the 225-entry working catalog, with named role types and no holder named. The accepted-autonomy register: no row, no class; the cause of the last narrowing; the recovery tail; the model and prompt pin.
Acequia, Inc. is an invented organization. These pages present a working design, not deployment results; its contracted stages and change freezes are illustrative. The sections below mirror the Governed Autonomy workbook (v0.50): its columns, rules, invariants and catalogs, as written, with the worked example's organization named as it is there. The deployment's own rows, parties, contract identifiers and configuration stay with the deployment; where a table's rows stay, its columns are shown.
01Human workers: the column designworkbook tab 12 · Workforce
What this is for. Which people and which machines may set up, do, or check each kind of work.
People and machines are listed apart. A machine can do the work, but a person sets it up and checks it. How to use it. Find the role. Read the kinds of work it may hold. A person is named later.
Role slots come from Work types: , , . Human workers may hold any slot. Machine workers hold the slot only. The class sits with the mission owner. Named holder stays UNASSIGNED, and no class is authorized, until that party names a person.
1. Human workers — roles, parent party, , and the slots each may hold
The columns · the rows stay with the deployment
Workforce ID
Role
Parent party
Join seat
Configurator for
Executor for
Verifier for
Class acceptor
Named holder
Derived from
022. Machine workers — a separate category; executor slot only, with a human operator and verifierworkbook tab 12 · Workforce
A machine worker executing a VETO-class work type holds no standing credential for it. The credential is issued per decision and expires with it ( §7, §3; ASM-36). The orchestration engine executes identity change only inside an accepted class.
A row is a role. The named holder stays UNASSIGNED until the parent party names a person. While the class acceptor is unassigned, no class is authorized.
The register is empty by design until a person accepts a class. Narrowing causes are measured, undefined, disputed or externally driven.
What this is for. One row per class a named person has accepted, at a named stage, with the facts the class gate needs.
No row, no class. A row is added only when a class passes its evidence and safety gates. Today the register is empty. How to use it. Find the class. Read who accepted it, at what stage, why it last narrowed, and what a model change does to it.
Schema ruled 2026-10-12. Cause of last narrowing takes the §6.7 values: measured, undefined, disputed, externally driven. The per-class recovery tail is adopted from once that section is published. Model identifier and system-prompt hash follow ; a change to either drops the class to shadow until regression passes. Class drafted by names who wrote the class definition; a machine-drafted class carries a human-written ceiling.
Zero classes accepted.
