# 4.7 The governance rule (/ai-worker-paradigm/the-architecture-in-one-picture/governance-rule) --- type: Document title: "4.7 The governance rule" description: "How the three owned systems of record split one job between them, and how a written policy becomes a control that software can enforce." status: stable order: 104.7 ksor: owner: team:panaversity audience: [ public ] approval: by: process:panaversity at: 2026-11-02T08:13:32Z chapter: "04" part: I expert_status: required concepts: [ "4.7" ] last_verified: 2026-10-04 sources: - id: v1-thesis title: "The Agent Factory Thesis (Panaversity, first edition, verified 2026-10-04)" resource: https://agentfactory1.panaversity.org/docs/thesis - id: dsor title: "DSoR, the Data System of Record (Panaversity, GitHub, verified 2026-10-04)" resource: https://github.com/panaversity/dsor generated: at: 2026-11-02T08:13:32Z by: esl-rewrite/1.2.0+ksor.1 trust_tier: unverified build_id: sha256:46fd53c5d7ab1c14f6347908d45c9fdaecda4d914439923ee878bdcecd57803e dirty: true ksor_version: 0.0.60 --- **In everyday life.** A gym's rule says members under 16 need a parent. The entry gate at the front desk is set to check age. The rule and the gate are different things. The book's governance rule splits the job of governing a worker between the three owned systems of record: **KSoR governs what an AI Worker may know. DSoR governs what it may do. SSoR governs what it may take as true right now.** May know means may answer from. The model knows many things, but the worker answers from the record or abstains. In plain words, SSoR governs what is true right now about the work: where each matter stands, and what it waits for. The facts underneath, such as whether an approval exists, belong to the company's systems, read through DSoR (4.3). The first edition's rule was that every worker runs against a system of record.[^v1-thesis] That rule survives, split in three, because knowledge, action and the state of the work need different governance. Knowledge changes by approval, and when the record has no answer, the worker abstains. Actions pass fixed checks, and a failed check means a refusal or a wait for a person. The state of the work changes only by recorded steps. So the worker takes where a matter stands from its case file, never from an email or from its own memory. KSoR and DSoR meet where a policy becomes a control. A policy is a sentence, and software cannot enforce a sentence. At Brightline it would work like this. 1. *In the KSoR.* AP policy v3 says invoices over $5,000 need the controller's approval before payment. It has an owner, Dave, and a version, approved September 1. 2. *Turned into a control by people.* One person turns the sentence into a control on the payment operation: amount over $5,000, require the controller's approval. A second person reviews it. The control records which policy version it was built from. 3. *In DSoR.* The $7,800 Midwest Packaging payment waits until Dave approves it from his own login. The evidence records the control, the policy version and his approval. At Brightline this is Dave and IT, and a handful of controls on two operations, payment and status, set in the accounting system's approval step and the product's settings. ![A policy becomes a control, in four steps. One, KSoR: the policy is written and approved. Invoices over $5,000 need the controller's approval, version 3, approved September 1. Two, control: the policy is turned into a control, written by one person and reviewed by a second, and the control records the policy version. Three, DSoR action: the control checks each action, and the $7,800 payment waits until Dave approves from his own login. Four, evidence record: the system keeps a record of who asked, under whose authority, which rule ran, who approved and what happened. A return arrow runs from the evidence back to the policy version. The banner: an audit can go back from any action to the exact policy version.](img/policy-to-control.png) *Figure 4.4. A policy becomes a control. An audit can go back from any action to the exact policy version.* No system does another's job. KSoR never decides whether an action is allowed, and DSoR never decides what the policy is. Only the SSoR keeps each matter's case file. When the policy changes, the DSoR specification requires the old control to be marked stale and its owner told, never switched off without telling anyone.[^dsor] The Role Contract is the source of every control, and at run time the control wins, because software runs controls, not sentences. A contract line that no control enforces yet is a target, not yet in place, and the lab asks you which one Dave's rule is. In 10-80-10 terms, people write the owned rules and controls in the first 10 percent, done once and in advance for a worker that never stops ([Chapter 3](../the-10-80-10-operating-rhythm/one-rhythm.md)). The worker runs in the rented layers through the middle 80, run after run, and adds each step to the case files as it works. People read the owned layers' citations and evidence in the final 10, at the times they choose: the approval queue, the flags, and Dave's Thursday review. [^v1-thesis]: The Agent Factory Thesis, Panaversity, first edition. [^dsor]: DSoR, the Data System of Record, Panaversity.