Governance
What checks the output, and what proves it ran.
Every letter First-Qualified drafts passes a structured gate before the participant is shown it. This page documents the gate, the six checks it runs, what each one costs in the decision, how the verdict is recorded, and what the system does not do.
The gate
Five stages. The last is always a person.
DETECT
A posting appears in a feed the company publishes.
MATCH
Scored against facts the participant wrote.
GENERATE
A letter drafted from those facts and nothing else.
GATE
Six checks run. A verdict and its record are written.
HUMAN SUBMITS
The participant opens the employer's site and sends it.
The checks
What the gate runs on every package.
| Check | What it tests | Cost if it fires |
|---|---|---|
| claims_supported | Every sentence that asserts something is matched to the participant's nearest recorded facts and tested for entailment. The worst claim sets the score. Model-backed | 12.0 fabricated_claim |
| pii_leak | The draft is scanned for email addresses, phone formats, identifier-shaped strings, address heuristics, and the participant's own listed sensitive terms. Deterministic | 4.0 pii_leak |
| protected_attribute_leak | The draft is checked for references to attributes protected under anti-discrimination law. Deterministic | 4.0 pii_leak |
| style_drift | Distance from the centroid of the participant's own writing samples, scored against how much those samples differ from each other rather than against a global norm. Model-backed | 0.8 style_drift |
| output_domain | Length bounds, required and forbidden sections, and structural rules for the letter itself. Deterministic | 0.5 domain_violation |
| unfilled_placeholder | A literal template marker left in the draft. The model is instructed to emit one rather than invent an unsupported claim, so this is the request being surfaced instead of shipped. Deterministic | 0.5 domain_violation |
The costs are pre-registered in the project's scope document and frozen for the pilot. They are published here because a cost structure that is only described is one nobody can check, and because tuning them after seeing a verdict is the error the pre-registration exists to prevent.
The decision
Three possible verdicts.
ALLOW
The tail risk of proceeding costs less than abstaining. The package is ready for the participant to read, edit and send.
What the participant seesThe package, with every check and its reading shown beside it.
SCALE
Proceed, but constrained. Deterministic evidence has capped how far the decision may run, and the path taken is stored with the record.
What the participant seesThe package, plus which check constrained it and by how much.
ABSTAIN
Holding costs less than sending. A claim the checks label contradicted forces this outright, whatever the other numbers say.
What the participant seesThe package held, with the reason. Nothing is deleted and nothing is sent.
The record
Every run is reconstructable.
- jd_snapshot
- profile_version_id
- prompt
- model_id
- generation_params
- artifacts
- governor_record_id
- governor_version
- governor_decision
- governor_policy
- check_configs
- scale_path
- generated_at
- edited_artifacts
- edit_distance
- submitted_at
Those are the columns a package actually stores, not a summary of them. Together they are enough to reconstruct the run: the posting as captured, the exact profile version the letter was written from, the prompt, the model, the policy and check configurations in force, the verdict, and what the participant changed before sending.
The verdict is also written to a separate append-only record. Both are protected by database triggers rather than by application code, so a later edit fails at the database whatever asks for it.
Replay · the same record, rendered for the participantThe framework
decision-governor
The gate is a separate open-source library, pinned at version 0.1.0 for the pilot. It takes the checks above, prices each outcome, and compares the tail risk of proceeding against the cost of holding — a conditional value-at-risk decision rather than a threshold on an average, so a single severe failure is not offset by several mild successes.
One rule sits outside that arithmetic. When a check labels a claim contradicted, the package abstains on the label alone. A confident-looking package is refused exactly as readily as a doubtful one.
Limits
What this does not do.
- Coverage is limited to the structured feeds companies publish. A role posted only on a custom careers page is not detected, and a company that cannot be watched properly is listed as unsupported rather than counted as covered.
- Detection latency is bounded by the poll interval. A posting that appears between polls waits for the next one.
- The gate checks the letter against the facts the participant recorded. It does not independently verify that those facts are true — it verifies that the letter does not go beyond them.
- Scores are comparable only within a score version. A change to the scoring rules requires a new version and a migration, and old scores keep the version that produced them.
- The immutability guarantees are enforced by database triggers. They protect against application-layer error, not against someone holding superuser credentials for the database.
- Ten participants cannot resolve a small effect. Whatever the pilot reports will be directional, and it will say so.
- The acceptance test for the claims-support check has an open finding, tracked and dated in the project's decision log, ahead of the pilot's start.