SureThink/Product/Pillar 04
Pillar 04 · Human-driven
The pipeline stops where
your policy says stop.
Every firm already has these rules. They live in a delegation matrix somebody updated in 2023, and they hold right up until a Friday afternoon when they don’t.
Authority limits
A ceiling on every role,
and a name above it.
A case that exceeds someone’s authority does not sit in their queue with a warning on it. It is not in their queue. It is in the queue of the person who can settle it, and the log records that it moved.
Analystreviews, does not signPrepares the file. Can correct an extraction; cannot settle the case.
Underwritersigns within limitSettles routine exposures. Past $500k the case refers up automatically.
Senior underwriterK. Osei · holds case #4471Covers the $1.28M bond. Above $1M a second signer is required — and it cannot be her.
Chief underwriting officerand the committee aboveBeyond this the case goes to committee, and the committee’s decision is recorded the same way.
Four-eyes approval
The second signer is required
by the system, not by convention.
Most four-eyes policies are honoured because people are conscientious. This one is honoured because the first signer is removed from the list of people who can be the second.
First signature
K. Oseisenior underwriter · 16:22:14signedEligible to counter-sign
M. Webbcompliance directoreligibleR. Halvorsenchief underwriting officereligibleK. Oseiexcluded — signed firstblockedWhat “enforced” buys you
- No self-approval, structurally. Not a warning, not an audit finding six months later. The name is absent from the picker.
- No shared logins to work around it. The exclusion is on the identity that signed, so borrowing a colleague’s session doesn’t help.
- Thresholds per pipeline. Bonds over $1M and KYC files over a risk band can require different second pairs of eyes.
- Both signatures on the record. Who, when, and what each of them could see at the time.
Corrections with provenance
When your underwriter
overrules the pipeline.
She reads note 9 herself, finds the figure, and enters it. The file does not quietly replace the pipeline’s number with hers — it keeps both, and puts her name on the change.
What the pipeline read
~$184,000
inferred note 9, prose only
Formed from the Site B contract value in the same file. Below the threshold, so it stopped.
What K. Osei decided
$184,200
entered by K. Osei FS_2025_audited.pdf, p.22
She found it in a schedule the extractor had filed as correspondence. The field now cites her, not the model, and says so wherever it appears.
Both figures stay in the record. An auditor asking what the pipeline had concluded gets an answer; so does a reviewer asking why a person overruled it. Neither has to take the other on trust.
Standard equipment
Six controls, on by default.
The controls that stop a bad decision are not an enterprise tier. Limits, four-eyes, refer-up and confidence gates enforce the same way for a team of four as for a team of four hundred, because the reason they exist has nothing to do with headcount. Observe mode and per-pipeline authority maps start on Growth.
| Control | What it does | State |
|---|---|---|
| authority_limit | Every role carries a ceiling. Past it the case escalates to someone who can settle it — it does not fall through, and it does not sit unowned. | enforced |
| four_eyes | Above your threshold a second signer is required, and the first pair of eyes is excluded by the system rather than by convention. | enforced |
| refer_up | A referral carries the whole file with it — everything the pipeline read, and everything the first reviewer saw. | enforced |
| confidence_gate | Below the grade you allow, the pipeline refuses to answer and parks the case rather than averaging its way to a number. | enforced |
| observe_mode | A new rule reports what it would have done, on live files, for as long as you want, before it is allowed to act. | optional |
| ai_budget | A daily ceiling per pipeline. Spend is metered per call and priced at write time; when the budget is gone the pipeline holds. | enforced |
The point of all of it
Seven hours is not a failure.
Case #4471 waited most of a working day. Nobody chased it, nothing expired, and the broker could see it was with an underwriter rather than lost.
An automation platform that measured itself on throughput would call that a queue problem. We call it the system working: the pipeline did four stations in four minutes, and then it waited for the one judgment it was never allowed to make.
Start with one workflow
Bring us the decision
nobody wants to sign alone.
Thirty minutes on your authority map. We set the limits and the four-eyes threshold the way your policy already reads, and show you what the system then refuses to let happen.
- A schematic of your workflow, yours to keep
- The rule pack it would screen against
- Your authority map, role by role
- A sample decision record and a cost per file