CAPABILITY 27 / 30

Who may see it, who may run it

A confidentiality ladder, roles that resolve to an answer, and the commands only an operator may run.

IN PRODUCTION

This runs in client systems today. The sample below was regenerated for a fictional company.

Access rules that cannot be resolved are wishes. These resolve: pick a role and a document or a command and get allowed or refused, with the level, the rule, and what to do instead. Personal and regulated material sits on its own rung with stricter handling, including what an assistant must refuse to repeat even when asked directly.

TRY IT / RUNS IN YOUR BROWSER

Use it here.

The mechanism is the production one. The company, the catalogue, and every figure are fictional.

Who may see what

The access ladder, and what an agent may do without a person

Three things that are usually written down separately and then contradict each other: how confidential a document is, what a role is allowed to do, and which commands a machine may run on its own. Here they are one rule set. Pick a role and anything the company holds, and the answer comes back allowed or refused, naming the level, the rule, and what to do instead.

THE OUTPUT / GENERATED FOR APEX INSTRUMENTS

What comes out.

JSON

Five levels, seven rules, thirteen documentsData · Public, internal, confidential, restricted, and personal and regulated. Each level says what belongs at it, who may read it, how it may be shared, what happens when it leaves, and what an assistant does with it, with a worked example document that argues why it sits there. The personal level carries five things never stored, five that must be redacted, and six an assistant refuses to repeat even when asked. The seven rules the resolver runs are published here as text, and each personal record names the purposes that open it, one of them naming none at all.Open the file ↗

JSON

Nine roles with their clearance, operator flag, and purposesData · Site visitor, partner site manager, named contractor, Apex employee, Marketing Lead, Account Manager, Customer Success Lead, Operations Lead, and COO. Each says what it reads, writes, approves, and runs, and the level it is cleared to. Two hold the operator flag. Two hold a lawful purpose. The partner role is cleared to confidential but only for material marked partner facing, which is the case rule R3 exists for.Open the file ↗

JSON

Sixteen commands and agentsData · Each carries what it does, the level it needs, whether it is operator only, whether it is staged, and the condition it stops on and hands back to a person. Seven are operator only, six are staged, ten are running. The two flags are independent and the file contains commands with each combination of them, so the difference is visible rather than asserted. Every staged command names what it is waiting on and why, so staged is a state with an exit.Open the file ↗

THE MECHANISM / SHOW THE SHAPE, NOT THE SOURCE

How it works.

What a skill is

01Rank the material
Five levels, each with what belongs there and how it may be shared.
02Clear the people
Each role has a level and an explicit set of what it may read, write, approve and run.
03Gate the commands
Some are operator-only. Some are staged and stop for a person.
04Resolve the request
Every combination returns allowed or refused, naming the rule.
05Refuse usefully
A refusal says what to do instead, not just no.

WHAT IT READS

A confidentiality level per document kind
A clearance and a permission set per role
A level and a flag per command
Handling rules for personal and regulated material

WHAT IT CHECKS BEFORE IT SHIPS

Every refusal names the level and the rule
Personal and regulated material has stricter handling than merely confidential
An operator-only command cannot be run by anyone else
A staged agent stops for a person by design

In production: a confidentiality ladder with rules for personal and regulated information, role-based access, staged agents, and operator-only commands.

The mechanism runs inside client systems. Everything on this page was regenerated for Apex Instruments, a company that does not exist. Client names, source files, and internal wording stay private.

What it produces What is being built next