Roles, authority & the open-door pipeline
A mock institution: C-suite → directors → managers → leads → techs, branched by department. Authority bands map directly to A.R.E.S. approval scope. Below: a live agentic helpdesk where employee suggestions flow up, auto-approve when low risk, and sync back to the user's app.
Authority bands by department
Each branch is an A.R.E.S. authority band. Approval scope inherits from level: tenant-policy needs c-suite/director, team-workflow needs manager/lead, user-preference is tech-initiated and usually auto-approved.
- Edit
- Constitution · Budgets · Connectors · Authority bands
- Approve
- Tenant-wide policy · External egress · New model classes
- Cannot
- Bypass Sphinx receipts
- Edit
- Dept gates · Dept budgets · Approver lanes
- Approve
- High-risk dept changes · Cross-team workflows
- Cannot
- Edit tenant constitution · Add model classes
- Edit
- Team SOPs · Queue routing · Macros
- Approve
- Team workflow patches · Medium-risk suggestions
- Cannot
- Edit dept budgets · Change authority bands
- Edit
- Lane configs · Quick replies · Density defaults
- Approve
- Low/medium UI patches for direct reports
- Cannot
- Approve external egress · Edit SOPs above team
- Edit
- Own layout · Own shortcuts · Own filters
- Approve
- Self-scoped low-risk suggestions (auto)
- Cannot
- Edit other users · Edit team workflow
Synthetic org chart. No SSO/HRIS is bound. Each card shows its A.R.E.S. scope (tenant.policy, department.policy, team.workflow, user.preference). Authority is inherited top-down — a suggestion is auto-routed to the lowest band that has edit + approve rights for its scope.
Pick a requester and action
Walks the authority chain from the requester up the tree, honors the live permission matrix, and emits an audit event with a receipt id.
Per-level × department rights
Toggle edit / approve / cannot per cell to preview how the simulator routes. Each change writes a permission.change event to the audit log.
Toggle each cell to preview how A.R.E.S. routing changes. The Routing Simulator above re-evaluates against the live matrix.
| Level / Department | Executive | Finance | HR | Facilities | Travel | IT | Operations | Legal |
|---|---|---|---|---|---|---|---|---|
| C-suite | ||||||||
| Director | ||||||||
| Manager | ||||||||
| Lead | ||||||||
| Tech / Operator |
Live suggestion → implementation pipeline
Any employee can propose a UI or workflow change from inside the app. A.R.E.S. classifies risk, Idol implements low-risk changes immediately, Sphinx verifies the patch, and the user gets a live in-app notification when their config syncs.
- lowuser.preferenceSynced to userPin folder-scan to left raild.alvarez · Operations · 12s ago · routed to Idol
- lowuser.preferenceAuto-approvedDefault Approver lane to inline diffa.singh · Finance · 44s ago · routed to Idol
- lowteam.workflowImplementingAdd quick-reply macro to CS lanem.reyes · Operations · 1m ago · routed to Idol
- mediumteam.workflowHuman approverAuto-bundle vendor receipts > $5kn.osei · Finance · 3m ago · routed to Human Approver
- lowtenant.policyA.R.E.S. reviewExpose tenure field on profile cardv.kaur · HR · 5m ago
- hightenant.policyBlockedBypass approval for hotels < $250c.romero · Travel · 8m ago · routed to Human Approver
- lowuser.preferenceSynced to userSticky filter on Receipts listf.kade · Operations · 11m ago · routed to Idol
- lowuser.preferenceIntakeCompact density on Approval queuet.brooks · Finance · now ago
Open-door, agentic. Employees submit UI/workflow suggestions from inside the app. A.R.E.S. classifies risk and scope: low-risk user prefs auto-approve and Idol pushes the change live with a notification, medium-risk team workflows route to a human approver, high-risk tenant policy is held. Every step writes a receipt.
Role × capability gates
The legacy authority matrix. Used by A.R.E.S. as the per-action sign-off table.
| Capability | Operator | Reviewer | Approver | Auditor | CIO |
|---|---|---|---|---|---|
| read.sop | Allow | Allow | Allow | Allow | Allow |
| draft.reply | Allow | Allow | Allow | Block | Advisory |
| approve.write | Block | Hold | Allow | Block | Allow |
| approve.external | Block | Block | Hold | Block | Allow |
| view.receipts | Allow | Allow | Allow | Allow | Allow |
| configure.gates | Block | Advisory | Hold | Advisory | Allow |
| request.pilot | Hold | Hold | Allow | Advisory | Allow |
| export.evidence | Block | Hold | Allow | Allow | Allow |
