Urban Decision OS · Saudi/Riyadh · review assurance

Governance & Human Review Control Tower

Controls how municipal evidence, scenarios, and executive outputs move from source registry to reviewer-cleared decision readiness.

Important

Review assurance is advisory-only. It documents review gates. No approval, no decline, no enforcement, no municipal-record write, no triggered automated action.

It documents evidence gates, reviewer authority, and locked outputs. No approval, no decline, no enforcement, no persisted municipal action.

Advisory only
Human review required
Evidence-linked
No automated decision
No production workflow

Control tower summary

Source registry
Every evidence item must be named, scoped, and provenance-checked before use.
Human review gate
No scenario, pack, or executive output advances without a named reviewer action.
Decision boundary
The platform prepares decision context; no approval, no enforcement, no inspection, no fine, no municipal record write.
Audit & trust log
Every consequential transition must be traceable through digest-verified review events.

Why it matters: evidence, scenarios, and executive outputs cannot move forward until source provenance, reviewer authority, and governance gates are clear.

Municipal assurance flow

Data sourcesPublic · candidate
Ingestion registryPartial registry
Evidence tokensNeeds review
Scenario eligibilityAdvisory preview
Human reviewRequired
Executive handoffLocked

Reviewer authority matrix

Role	Can do	Cannot do	Gate
Intake reviewer	Verify source provenance; attach reviewer note.	Advance band; approve buyer pack.	Source provenance.
Case reviewer	Confirm evidence sufficiency; record reviewer note.	Promote to executive brief readiness alone.	Evidence sufficiency.
Senior reviewer	Concur on executive readiness; gate output release.	Bypass evidence gate; persist municipal record.	Senior concurrence.
Executive reviewer	Read executive brief; request scope change.	Approve municipal decision; trigger municipal action.	Executive read.

Why this matters for a municipal pilot

A governed municipal intelligence pilot must prove operational value without weakening privacy, sovereignty, reviewer authority, or public-sector accountability. This control tower keeps intelligence useful while preserving institutional decision control.

Compliance-safe adoption
Reviewer accountability
Evidence discipline
Executive confidence

Review state model, transition ladder, derived posture map, assurance checklist, blocked evidence handling, reviewer note model, static audit-row preview, and companion surfaces remain available for audit review.

Audit details · review states, transition ladder, assurance checklist, reviewer notesExpand audit

Expand to read the full review-state and transition lattice, evidence sufficiency gate, blocked-clearance handling, reviewer-note model, assurance checklist, scenario assurance, static audit-row preview, companion surfaces, and structural invariants.

Current corpus review posture

Source registry records

Evidence tokens (curated)

Pending human review

Blocked tokens

Reviewer roles

intake_reviewer
Intake reviewer
Responsibility
Receives a new case; runs the evidence sufficiency gate; routes to a case-reviewer or back to evidence-gathering.
Sign-off authority
Cannot mark a case ready for executive review.
Cannot do
Cannot advance a case past the sufficiency gate without a recorded reviewer note.
case_reviewer
Case reviewer
Responsibility
Performs the substantive per-case review; annotates the evidence pack; records caveats; hands off to senior-reviewer when complete.
Sign-off authority
Cannot mark a case ready for executive review without senior-reviewer concurrence.
Cannot do
Cannot bypass the senior-reviewer concurrence step. Cannot record an outcome on behalf of the executive reviewer.
senior_reviewer
Senior reviewer
Responsibility
Concurs with or rejects the case-reviewer's pack; can demand additional evidence; signs off the pack as ready for executive review.
Sign-off authority
Can mark a case as `ready_for_executive_review`.
Cannot do
Cannot record the executive reviewer's decision. Cannot route a sovereign-tier-blocked case forward.
executive_reviewer
Executive reviewer
Responsibility
Final external sign-off — the named human who would actually act, if action were within the platform's posture (which it is not).
Sign-off authority
Records accept / defer / decline. The platform records this decision in the audit-row preview but never acts on it.
Cannot do
Cannot trigger any platform action. Any downstream act of authority happens outside the platform.

Review state model (process — canonical)

queued · queued
Meaning
New case; not yet picked up by an intake-reviewer.
Allowed UI
Read-only token preview.
Required reviewer action
Intake-reviewer runs the sufficiency gate.
What cannot happen
No automated transition. No platform-driven assignment.
Advancement criteria
All five sufficiency-gate rules pass.
Governance caveat
Intake decision is the institution's, not the platform's.
in_review · in_review
Meaning
Case-reviewer is actively working the pack.
Allowed UI
Read + reviewer note.
Required reviewer action
Case-reviewer assembles the pack and annotates caveats.
What cannot happen
No platform-driven escalation. No automated approval.
Advancement criteria
Pack-complete and senior-reviewer concurrence.
Governance caveat
Reviewer note required for every change.
awaiting_evidence · awaiting_evidence
Meaning
Pack paused; the case-reviewer has identified a gap.
Allowed UI
Read; awaiting sentinel rendered.
Required reviewer action
Case-reviewer requests specific evidence.
What cannot happen
No automated regression. No platform-driven re-queue.
Advancement criteria
Missing evidence arrives.
Governance caveat
Reviewer-of-record records what is missing.
ready_for_executive_review · ready_for_executive_review
Meaning
Pack complete and senior-reviewer concurs.
Allowed UI
Read with locked pack view.
Required reviewer action
Executive-reviewer reads the pack and records a decision.
What cannot happen
Platform never writes. No automated handoff.
Advancement criteria
Executive decision: accept / defer / decline.
Governance caveat
Decision is advisory to the institution.
closed_accepted · closed_accepted
Meaning
Executive-reviewer recorded acceptance.
Allowed UI
Read-only closed-state view.
Required reviewer action
None — terminal.
What cannot happen
Platform never acts on acceptance.
Advancement criteria
(terminal — no further advancement)
Governance caveat
Acceptance is advisory; downstream action is off-platform.
closed_deferred · closed_deferred
Meaning
Executive-reviewer recorded deferral.
Allowed UI
Read-only closed-state view.
Required reviewer action
None — terminal.
What cannot happen
Platform never auto-reopens.
Advancement criteria
(terminal)
Governance caveat
Deferral is the executive's, not the platform's.
closed_declined · closed_declined
Meaning
Executive-reviewer recorded decline.
Allowed UI
Read-only closed-state view.
Required reviewer action
None — terminal.
What cannot happen
Platform never marks the case as 'rejected'.
Advancement criteria
(terminal)
Governance caveat
Decline is advisory; no enforcement.

Derived posture map (presentation aid)

not_assigned · Not assigned
Derived from states:queued
Signal
Case has no intake-reviewer of record.
Reviewer-facing cue
Awaiting institutional intake.
pending_review · Pending review
Derived from states:queued · in_review
Signal
Pack has not yet been concurred by a senior reviewer.
Reviewer-facing cue
Routine review path.
evidence_incomplete · Evidence incomplete
Derived from states:awaiting_evidence
Signal
Sufficiency gate identified a missing facet.
Reviewer-facing cue
Evidence-gathering required before advancement.
governance_blocked · Governance blocked
Derived from states:queued · in_review · awaiting_evidence
Signal
Pack contains a token with `ui_state: blocked` or a sovereign-tier reference.
Reviewer-facing cue
Senior-reviewer escalation required.
reviewer_note_required · Reviewer note required
Derived from states:queued · in_review · awaiting_evidence · ready_for_executive_review
Signal
Every transition carries `reviewer_note_required: true`.
Reviewer-facing cue
Note is a structural requirement, not optional.
ready_for_senior_review · Ready for senior review
Derived from states:in_review
Signal
Case-reviewer marked the pack pack-complete.
Reviewer-facing cue
Senior reviewer reads and concurs or rejects.
executive_brief_ready · Executive brief ready
Derived from states:ready_for_executive_review
Signal
Pack is complete and senior-reviewer concurrence is on record.
Reviewer-facing cue
Brief may include the verbatim caveat; never a recommendation.
blocked_from_decision_layer · Blocked from decision layer
Derived from states:queued · in_review · awaiting_evidence
Signal
Composite readiness band is D (per Engine Blueprint § 7).
Reviewer-facing cue
Only the Governance Readiness Gap scenario remains eligible at band D.

Transition ladder

queued → in_review
Reviewer
intake_reviewer
Concurring reviewer
—
Evidence basis
All five sufficiency-gate rules pass.
Governance check
No token at `inclusionTier: never`. No banned-claim violation.
Audit event type
evidence.sufficiency-gate.passed
What cannot happen
Intake-reviewer cannot concurrently mark the case ready for executive review.
reviewer_note_required: true
queued → awaiting_evidence
Reviewer
intake_reviewer
Concurring reviewer
—
Evidence basis
Sufficiency gate identified at least one missing facet.
Governance check
Reviewer note records which facet is missing.
Audit event type
evidence.sufficiency-gate.failed
What cannot happen
Intake-reviewer cannot guess at the missing evidence — the note must be specific.
reviewer_note_required: true
in_review → awaiting_evidence
Reviewer
case_reviewer
Concurring reviewer
—
Evidence basis
Case-reviewer identifies a gap during pack assembly.
Governance check
The note must cite the specific facet and source-registry record needed.
Audit event type
review.state-transition
What cannot happen
Case-reviewer cannot freeze the pack indefinitely without a recorded reason.
reviewer_note_required: true
awaiting_evidence → in_review
Reviewer
case_reviewer
Concurring reviewer
—
Evidence basis
Missing evidence arrives and the case-reviewer accepts it into the pack.
Governance check
New evidence must pass the same source-registry checks as the original pack.
Audit event type
evidence.arrived
What cannot happen
The pack cannot regress to `queued`; only `awaiting_evidence ↔ in_review` is allowed.
reviewer_note_required: true
in_review → ready_for_executive_review
Reviewer
case_reviewer
Concurring reviewer
senior_reviewer
Evidence basis
Pack-complete; senior-reviewer reads and concurs.
Governance check
Senior-reviewer concurrence is mandatory; case-reviewer alone cannot advance.
Audit event type
review.state-transition
What cannot happen
No platform shortcut. No 'trusted-reviewer' override.
reviewer_note_required: true
ready_for_executive_review → closed_accepted
Reviewer
executive_reviewer
Concurring reviewer
—
Evidence basis
Executive reviewer reads the locked pack and records acceptance.
Governance check
Acceptance is advisory; the platform never acts on it.
Audit event type
review.state-transition
What cannot happen
Platform never auto-applies the executive's acceptance to any external system.
reviewer_note_required: true
ready_for_executive_review → closed_deferred
Reviewer
executive_reviewer
Concurring reviewer
—
Evidence basis
Executive reviewer records a deferral with a reasoned note.
Governance check
Deferral is advisory; the platform never auto-reopens.
Audit event type
review.state-transition
What cannot happen
No countdown to auto-reopen. No automated reminder.
reviewer_note_required: true
ready_for_executive_review → closed_declined
Reviewer
executive_reviewer
Concurring reviewer
—
Evidence basis
Executive reviewer records a decline with a reasoned note.
Governance check
Decline is advisory; no platform-driven follow-up.
Audit event type
review.state-transition
What cannot happen
Platform never categorises the case as a 'violation' or 'rejection' externally.
reviewer_note_required: true

What cannot happen

No automated transition between any two states.
Operating model § 9 + § 11 — every transition emits a JSONL row triggered by a named reviewer.
No transition to `ready_for_executive_review` without senior-reviewer concurrence.
Operating model § 4 — case-reviewer's authority is bounded by senior-reviewer concurrence.
No bypass of the sufficiency gate. A failing case stays `queued` or `awaiting_evidence`.
Operating model § 6 — gate is rule-based and transparent.
No advancement from a sovereign-tier-blocked case. The block is terminal.
Operating model § 7 — sovereign-tier escalation is not an escalation; it is a block.
No re-opening of a closed case. A reopened case starts a new case ID with the prior ID referenced in lineage.
Operating model § 5 — terminal closed states never regress.

Evidence sufficiency gate

Source provenance checked · partial
Current corpus outcome
Partial — reviewer-side verification not yet recorded.
Every token cites a Source Registry record whose `live_api_access: false` and `official_integration: false` invariants hold.
Tokens not yet attested:tok.usgs.core.context · tok.usgs.east.context · tok.usgs.north.context · tok.usgs.south.context · tok.usgs.west.context · tok.saudi.balady.surface · tok.rega.market.signal · tok.gastat.national.signal · tok.pack.metadata.completeness · tok.governance.note
Reviewer action when not yet attested
Case-reviewer records a reviewer note attesting that each token's source-registry record has been read and verified.
Metadata completeness checked · partial
Current corpus outcome
Partial — all tokens carry the pending sentinel; per-asset provenance still pending.
Every token's `time_window` field carries the canonical 'Source registry validation pending' sentinel or a verified value.
Tokens not yet attested:tok.usgs.core.context · tok.usgs.east.context · tok.usgs.north.context · tok.usgs.south.context · tok.usgs.west.context · tok.saudi.balady.surface · tok.rega.market.signal · tok.gastat.national.signal · tok.pack.metadata.completeness · tok.governance.note
Reviewer action when not yet attested
Case-reviewer attaches the missing metadata or escalates to senior-reviewer.
Geography / time fit checked · passes
Current corpus outcome
Passes — every token uses RIYADH region / Riyadh governorate, optionally with illustrative zone label.
Pack geography stays at region / governorate / zone level. No per-property identifier. No point coordinate.
Reviewer action when not yet attested
(no action required at current corpus)
Evidence diversity checked · passes
Current corpus outcome
Passes — 6 evidence classes present in the current corpus.
At least three evidence classes (imagery / surface / statistical / overlay / governance_note / metadata) present.
Reviewer action when not yet attested
(no action required at current corpus)
Governance limitations reviewed · partial
Current corpus outcome
Partial — limitations are populated structurally; reviewer-side acknowledgement not yet recorded.
Every token's `limitations[]` array has been read and acknowledged in a reviewer note.
Tokens not yet attested:tok.usgs.core.context · tok.usgs.east.context · tok.usgs.north.context · tok.usgs.south.context · tok.usgs.west.context · tok.saudi.balady.surface · tok.rega.market.signal · tok.gastat.national.signal · tok.pack.metadata.completeness · tok.governance.note
Reviewer action when not yet attested
Senior-reviewer records a note acknowledging each token's limitation set.

Blocked evidence handling

clearance-tok.pack.metadata.completeness
origin_token_id:tok.pack.metadata.completeness
Reviewer:senior_reviewer
Clearance steps
1. Complete per-asset provenance review for the underlying source.
2. Re-classify the token's `ui_state` upstream of the platform; the platform reads the new state from the registry.
3. Record a senior-reviewer note attesting to the clearance.
4. Emit the audit row preview (`evidence.unblocked`) before any cited scenario consumes the token.
Audit event type:evidence.unblocked
Governance caveat
The platform never unblocks a token on its own. Clearance happens externally; the platform reflects it.
No bypass:No reviewer at any level may route a blocked token forward. The block is bypass-proof.

Reviewer note model

reviewer_note_required: true

Must include

The reviewer-of-record's externally-issued identifier (institution-issued; never a per-person tracker).
The from_state and to_state of the recorded transition.
An explicit citation of the evidence_pack_token_ids the note relies on.
A bilingual rationale caveat that names what the note does not assert.

Cannot do

Cannot replace the institution's existing review hierarchy.
Cannot recommend a regulatory outcome (the platform recommends readiness, not outcomes).
Cannot expose per-reviewer productivity, leaderboards, or per-reviewer disagreement rates.

Links to audit preview

Each reviewer note is referenced by event_id in the static audit-row preview rendered below; no real audit row is written by this surface.

Supports executive brief

The senior-reviewer's concurring note is a precondition for the `ready_for_executive_review` state and for citing any scenario in an executive brief.

Assurance checklist

Source provenance
Prompt
Has every pack source been verified against the Source Registry for `live_api_access: false` and `official_integration: false`?
Reviewer:case_reviewer
What cannot happen
No live-API claim. No official-integration claim.
reviewer_note_required: true
Metadata completeness
Prompt
Does every token's `time_window` carry the pending sentinel or a verified value?
Reviewer:case_reviewer
What cannot happen
Reviewer cannot infer a date the platform did not record.
reviewer_note_required: true
Geography / time fit
Prompt
Does the pack's geography stay at region / governorate / zone level (no per-property identifier, no point coordinate)?
Reviewer:case_reviewer
What cannot happen
Reviewer cannot publish a coordinate the platform does not assert.
reviewer_note_required: true
Evidence diversity
Prompt
Are at least three evidence classes (imagery / surface / statistical) present?
Reviewer:case_reviewer
What cannot happen
Reviewer cannot cite a scenario whose evidence basis is not satisfied.
reviewer_note_required: true
Governance limitations
Prompt
Has each token's `limitations[]` array been read and acknowledged in the reviewer note?
Reviewer:senior_reviewer
What cannot happen
Senior-reviewer cannot waive a constitutional limitation.
reviewer_note_required: true
Scenario dependency
Prompt
Does each cited scenario's `evidence_basis` actually hold against the current pack?
Reviewer:case_reviewer
What cannot happen
Reviewer cannot cite a scenario that lacks its required evidence classes.
reviewer_note_required: true
Dynamic interaction trace
Prompt
Have the dynamic-interaction cross-references been read for the case's bands / tokens / scenarios?
Reviewer:case_reviewer
What cannot happen
Dynamic interaction cannot create a transition. Reviewer must record the transition manually.
reviewer_note_required: true
Limitation note approved
Prompt
Is the bilingual fixed disclaimer rendered above every projection acknowledged in the reviewer note?
Reviewer:senior_reviewer
What cannot happen
No paraphrase of the constitutional disclaimer is permitted.
reviewer_note_required: true
Executive brief caveat
Prompt
Does the brief include the verbatim caveat: 'not a decision, not a recommendation, not a production simulation'?
Reviewer:senior_reviewer
What cannot happen
Senior-reviewer cannot drop the caveat from a downstream brief.
reviewer_note_required: true
Reviewer-of-record identified
Prompt
Is the named reviewer-of-record recorded with their externally-issued identifier (no per-person tracker)?
Reviewer:senior_reviewer
What cannot happen
Platform does not create new authorities. Reviewer identity is institution-issued.
reviewer_note_required: true

Scenario assurance

Scenario preview cannot override a review state. Eligibility is qualitative, never binding.
Dynamic interaction cannot create a transition. Every transition is recorded by a named reviewer.
Readiness band limits scenario use. At band D only the Governance Readiness Gap scenario remains eligible.
Human review is required before any scenario citation in an executive brief.
No forecast, no recommendation, no production simulation, regardless of how many scenarios are cited.

Static audit-row preview

is_preview: true

Static audit-row preview

Preview only. Not written. Not persisted. Not a live audit log. Not an API output.

event_id

preview-event-illustrative-only

event_type

review.state-transition

case_id

preview-case-illustrative-only

review_lane_id

review-lane-riyadh-active

from_state

in_review

to_state

ready_for_executive_review

reviewer_of_record_role

case_reviewer

concurring_reviewer_role

senior_reviewer

reviewer_note_required

true

payload_sha256_placeholder

"—"

evidence_pack_token_ids

tok.usgs.core.context · tok.usgs.east.context · tok.usgs.north.context

rationale_caveats

· Demonstration corpus only — not production decisioning.
· No GIS-coordinate accuracy claim.

reviewer_note

Pack-complete. Senior reviewer concurs after reading per-token limitation sets and the dynamic interaction trace. No production simulation, no recommendation, no automated decision.

Companion surfaces

Structural invariants

human_review_required: trueautomated_decision: falseno_persistence: truereviewer_note_required: trueis_preview: true

Projection computed at: 2026-06-14T13:15:23.090Z · Operating model: docs/strategy/human_review_operating_model_v1.md · Scoring methodology: docs/strategy/decision_readiness_scoring_methodology_v1.md