The GOVENANT Standard — Part 1: The Organization Model

The core objects, their relationships, and the accountability geometry. Everything else in the standard is a mechanism that enforces something defined here.

1.1 The object model

erDiagram TENANT ||--o{ ROLE : "instantiates (as data)" ROLE ||--|| CHARTER : "is bounded by" ROLE ||--|| OCCUPANT : "is filled by (swappable)" ROLE ||--o{ DUTY : "owes (the coverage contract)" CHARTER ||--o{ LEVER : "owns (exactly one owner each)" DUTY ||--o{ ACTION : "fires" ACTION ||--|| RECORD_ROW : "writes (append-only)" ACTION ||--o| OUTCOME : "must verify (Law 2)" ACTION ||--o| PREDICTION : "must ledger (falsifiable)" ROLE ||--o{ REQUEST : "files when lever unowned" HUMAN ||--o{ CONSTITUTION : "locks / directs / approves" CONSTITUTION ||--o{ ROLE : "governs"

Object	Definition	Key property
Tenant	One governed organization instance (a brand, a client, a project group).	Same role code everywhere; all behavioral difference is tenant data.
Role	A durable position in the org: title, authority, accountability. Exists independently of who fills it.	The durable asset. Stored as data, not constants.
Occupant	Whatever currently fills a role: an LLM (any model), a deterministic function, or a human.	The replaceable commodity. Swappable by config, without reorganizing.
Charter	The role’s constitution: what it owns, what it may request, what it consumes.	The blast radius of a compromised or confabulating occupant is its charter — never the platform.
Lever	A named actuator that changes the world (send_volume, deploy_gate, filing_release).	Exactly one owning role. Pulling an unowned lever is impossible; the attempt converts to a request.
Duty	One declared unit of a role’s job: trigger + expected outcome + SLA. The atom of coverage (Law 3).	A charter responsibility with no duty is an uncovered job; a duty outside the charter is scope creep. Both are audit findings.
Terminal edge	The boundary where the org touches reality: email sent, PR merged, filing submitted.	The only place delivery can be measured. Everything upstream is motion.
Record	The single append-only ledger of actions, decisions, validations, approvals, costs.	Serves five jobs at once: coordination, compliance, cost accounting, oversight, customer feed.
Constitution	The human control plane above the action path.	Steers, never gates. A human edit locks a key against agent overwrite.

1.2 Role vs. occupant — the load-bearing separation

The classic OCMAS move: separate the role from the occupant, and mean it. Concretely:

Swapping GPT-class for Claude-class in the CFO seat is a config write, not a refactor.
Replacing an LLM reviewer with a deterministic linter for one duty is a duty edit.
A human can occupy any role temporarily (vacation coverage for a paused agent) because the charter, duties, and levers don’t change — only the occupant does.

This is why every dimension of a role must be data (Part 2): a role whose persona lives in a code constant cannot be re-occupied without a deploy, which means the organization is not actually separate from its staff.

1.3 Authority geometry — separation of powers

flowchart LR A[Role A decides] --> G{Ownership check:\ndoes A own this lever?} G -- yes --> V[Validation gate] --> X[Guarded execution] --> O[Outcome verified] G -- no --> R[executive_request filed\nto the owning role] R --> B{Owner resolves} B -- accept --> V B -- reject --> L[Ledgered rejection\nwith reason]

Three invariants, all Law 1:

Single ownership. Every lever has exactly one owner in a registry. Ownership is itself reassignable at runtime (a config write with provenance) — but never ambiguous.
Conversion, not denial. An unowned pull does not error; it becomes a request routed to the owner. Cooperation is the only path that exists. A request lane with writers but no live resolver is a broken org (the reference system once had zero resolveRequest callers — cooperation impossible by construction).
The check re-fires at every actuation surface. Commit paths, chat/boardroom proposals, scheduled sweeps, and inside every write-tool handler. The single most common real-world failure (anti-pattern AP-5) is a gate that holds at the decision surface while delivery code calls the vendor API directly.

1.4 The RACI of a governed organization

The whole authority model compresses to one slide — useful both internally and for buyers:

RACI	OCMAS object	Mechanism
R — Responsible (does the work, when)	Duty roster	Each duty names its role, trigger, and expected outcome (Part 3).
A — Accountable (owns the call)	Charter + lever registry	Exactly one owner per lever; predictions ledgered under the owner’s name (Part 6).
C — Consulted	Request lane	Non-owners influence only by filing `executive_requests` to the owner.
I — Informed	Standup + boardroom + record	Daily per-tenant standup; every action visible in the append-only record (Part 11).

1.5 Scoping — platform > tenant > project

Every registry in this standard (roles, prompts, skills, tools, context, duties, config, lever owners) resolves with the same precedence:

project override  >  tenant override  >  platform default  >  code fallback

Design decisions this forces from day one:

Scope columns are scope_kind (platform | tenant | project) + scope_id, not a bare tenant_id — retrofitting a project level later touches every table.
Default posture: roles behave consistently across a tenant; project-level overrides are reserved for genuine per-project expertise (a context pack, a stricter gate), not personality drift.
Cross-scope isolation is structural: an identity’s scope derives server-side (e.g. from a key hash), never from client input.

1.6 An example organization (GTM instantiation)

flowchart TD H[Constitutional Human] --- CEO[Operator / Boardroom] CEO --- CMO[CMO — owns: content_policy, campaign_activate] CEO --- CRO[CRO — owns: send_volume, segment_pause, discovery_tune] CEO --- COO[COO — owns: agent_throttle, prompt_fix*] CEO --- CFO[CFO — owns: budget_allocation, spend_cap] CMO --- J[Content agent] CMO --- P[Publicist agent] CRO --- M[Outreach agent] CRO --- R[Reply/booking agent] COO --- Q[Grader agent]

* Note the audit lesson baked into this example: when the COO both grades agents and owns the prompt_fix lever that “fixes” them, it is judge, jury, and executioner — the grading chain must terminate in an independent assertion (Part 6, §6.6).

The same diagram retargets to engineering (CTO/VPE/SRE/Sec → scout/architect/implementer/reviewer/ tester/release) or legal without touching the substrate. The org chart is rendered live from the role registry — a runtime rename or reassignment redraws it; a static diagram is an L0 org chart.

1.7 Coordination discipline — stigmergy only

Agents never import or call each other. All cross-role influence flows through shared state: the record, the event bus, the request lane, the agenda. import { runX } from '../agents/x' inside another agent is a bug, greppable, and an audit check.

This is what makes the organization auditable at all: because coordination is stigmergic, the org’s own tables can testify against it — which is exactly how both reference audits worked.

1.8 Glossary

Term	Meaning
Actuation surface	Any code path that can produce a side effect: commit paths, tools, sweeps, webhooks, chat.
Blackboard	The live shared-state read model agents deliberate over.
Coverage	The Law-3 property: every charter responsibility maps to a live duty, and every due duty resolves to delivery or a reasoned skip.
Duty-delivery ratio	Duties that produced their asserted outcome ÷ duties due, per role per window. The single best health number.
Flatlined / performed autonomy	Motion without delivery: fluent decisions, logs, and drafts with no verified terminal outcomes.
Motion vs delivery	Runs completed vs outcome rows that exist. Divergence is the core audit finding.
Objection window	Proposals auto-commit after N hours unless a human vetoes — governance steers without gating throughput.
Sticky lock	A human config edit that no agent write can overwrite.
Terminal edge	See §1.1. Where delivery is real.