<!-- DOCUMENT CLASS: PUBLIC | SOURCE: 21_GOVERNANCE_AUTHORITY_AND_APPROVAL.md --> <!-- STATUS: Aligned with Founder Canon (31 August 2026) -->

Governance, Authority & Approval

The Tier-0 Principle

Business Context is the semantic foundation of SpineWorkspace. Governance exists to protect Business Context. Without Business Context, governance has nothing to protect.

Governance model

Identity
→ Tenant
→ Role
→ Responsibility
→ Authority
→ Permission
→ Capability
→ Policy
→ Approval
→ Execution

Authority classes

• observe;
• derive;
• recommend;
• communicate;
• approve;
• mutate;
• administer.

Human authority

Humans retain consequential responsibility where policy or organizational role requires it.

AI authority

AI capability does not imply AI authority.

Confidence does not grant authority.

Approval

An approval must bind:

• tenant;
• principal;
• Work;
• action/capability;
• candidate version;
• authority scope;
• timestamp;
• policy version;
• audit record.

Rejection / modification

The user may:

• reject;
• modify;
• redirect;
• request more context;
• consult another human.

External communication approval

Slack/email/chat responses may initiate an approval workflow, but must be converted into verified approval events before consequential execution.

Core law

Nothing should acquire consequential authority merely because a model, agent or workflow produced a confident result.