Phase 1 · Deliverable 06 of 10

Role visibility and action-permission matrix

Least privilege by default. Visibility answers "what data can this role see"; action rights answer "what can this role do". The lens never widens either. AI inherits the requester's scope and holds no action rights.

DRAFT v0.1 · FOR APPROVAL AUTHORITY LIMITS: PLACEHOLDER (DoA)

6a · Visibility (data scope)

Full = all entities. Own = own entity only. Domain = assigned function within own entity. Assigned = only items assigned to the user. Summary = aggregated, no transaction rows. Material = only items at or above the materiality threshold. — = not rendered (D-12).

Information domain

OWN

CGE

ENX

FNL

MOC

ANL

ACO

INC

ASR

ADM

Lenses available

Owner (+ Core Group read: D-21)

Core Group + Entity (any in scope)

Entity (own)

Entity (domain)

Assurance views in scope

Scoped views

Entity (assigned)

Incident scope

Assurance views

None (admin console)

Requester's

Group and portfolio KPIs

Full · summary

Full

—

Assigned KPIs

Assigned

—

Incident-linked

Review scope

—

Requester's

Peer-entity comparison

Full

— (D-16)

—

Assigned

—

Review scope

—

Requester's

Entity and plant performance

Summary to plant

Full to plant; line on drill

Own, to line

Domain, to line

Assigned

Incident scope

Review scope

—

Requester's

Transaction and reconciliation records

—

Counts only

Own

Domain

Assigned

—

Review scope

Mappings metadata

Requester's

Cash upstreaming and group treasury

Full

Own obligation (C-05)

Finance domain

Assigned

—

Incident-linked

Review scope

—

Requester's

Alerts and cases

Material only

All material + entity summaries

Own

Domain

Linked to own KPIs

Assigned

Incident

Review scope

—

Requester's

Risk, compliance, EHS, audit findings

Material summary

Full

Own

Domain

—

Assigned

Incident

Full in scope

—

Requester's

Certification, lineage, evidence

Status only

Governance view

Own status

Domain status

Full in scope

Own evidence

Incident evidence

Full in scope

Mapping lineage only

Requester's

War rooms

View all active (critical)

View and coordinate

Own entity

If member

—

If member

Full

View

—

Disclosure-review state

View

—

View

—

AI explanations, briefs, Ask

Own scope

—

Never exceeds requester

6b · Action permissions

YesPermitted

ScopeOnly within assigned scope or authority

ReqMay request or recommend only

DraftAI drafts for human acceptance

—Not permitted; control not rendered

Action

OWN

CGE

ENX

FNL

MOC

ANL

ACO

INC

ASR

ADM

View and acknowledge alert (not ownership)

Yes

Scope

Yes

—

Accept ownership

—

Req

Scope

—

Scope

—

Draft

Assign supporting action

—

Scope

—

Req

Scope

—

Draft

Update status

—

Scope

—

Scope

—

Attach evidence

—

Scope

—

Run scenario

Req

Yes

Scope

—

Scope

—

Scope

—

Draft

Publish scenario as decision basis

—

Yes

Scope

—

Req

—

Escalate

Req

Yes

Req

Yes

Req

—

Draft

Open war room

Req

Yes

Req

—

Yes

—

Intervene in critical escalation

Yes

Req

—

Make permitted strategic decision

Scope

—

Request analysis

Yes

—

Yes

—

Draft executive update

—

Yes

Scope

—

Yes

—

Draft

Approve communication (Core Group / Owner update)

—

Yes

Scope

—

Req

—

Request closure

—

Req

—

Req

—

Approve or reject closure (D-06 tiers)

—

Scope

—

Req

—

Check

Reopen closed case

Req

Yes

Req

—

Yes

—

Certify KPI

—

Scope

—

Check

Certify with exception

—

Scope

—

Check

Request data correction

—

Req

Yes

Req

—

Req

—

Check

Approve KPI override (D-17)

—

Scope

—

Req

—

Maintain approved mappings / config

—

Req

—

Scope

—

Accept material risk

Scope

Req

—

Req

—

Approve disclosure (Disclosure Authority — PLACEHOLDER)

—

Req

—

Req

—

Release daily Owner brief

—

Yes

—

Draft

Maintain live facts in war room

—

Req

—

Req

—

Yes

—

Draft

Approve permitted local action within [DoA — PH] (v0.2)

—

Scope

—

Add business explanation or comment (v0.2)

—

Yes

Scope

—

Draft

Document action dependency (v0.2)

—

Scope

—

Scope

—

Maintain decisions log and communication drafts (v0.2)

—

Scope

—

Yes

—

Draft

Review, sample, challenge certification / controls / evidence / overrides / closure (v0.2)

—

Req

—

Yes

—

Check

Certify consolidated group-scope KPI (v0.2, D-22)

—

Scope

—

Check

6c · Hard governance rules (enforced in UI and service)

GR-01

AI has no approval authority

AI cannot certify a KPI, approve a financial number, accept material risk, approve disclosure, close a material case or assign accountability. AI-originated items carry an 'AI draft' tag until a human accepts them. Approval controls are never pre-filled.

GR-02

No self-approval of closure

The action owner and the closure approver must be different users unless an explicit, audited authorisation exists.

GR-03

Certification within scope only

A certifier sees certification controls only for KPIs and nodes assigned to them. For leadership KPIs, the metric owner may not also certify (D-02).

GR-04

Administrator has no business authority

A mapping or config change moves the affected KPIs to 'Pending certification' and writes an audit entry. Admin has no certify, accept-risk or close controls.

GR-05

Assurance is read-only on business data

The Assurance Reviewer may comment, challenge, sample and reopen, but never edits values, actions or evidence.

GR-06

Lens never widens scope

Switching lens changes depth and layout only. Entitlement scope is applied before render, search, AI and notification.

GR-07

Core Group cannot alter source facts

Core Group coordinates, routes, escalates and governs. Facts change only by source correction and re-certification.

GR-08

Owner visibility is gated by materiality

Push to the Owner only at or above [OWNER THRESHOLD — PLACEHOLDER]. Pull below the threshold is labelled 'Below materiality threshold' (D-04).

GR-09

No leakage through restricted states

Restricted items show no values, counts, names or titles outside parent scope. Search and Ask never confirm that they exist (D-12).

GR-10

Every write is audited

Acceptance, decision, certification, override, escalation, evidence, communication approval, closure and reopen are recorded with role, time, rationale and prior state.