# STEWARD Workflows, Launch & Adoption Plan

Each workflow is runnable only as a preview or explicitly approved one-run. It links one power, one functional template and one typed schema. It never silently contacts a person, changes a schedule, allocates staff, modifies a budget, submits a claim, commits a vendor or contract, publishes a report, changes a security permission, or writes an official record.

## Twenty-four runnable workflow cards

### WF-01 — Strategic North Star, Mandate & Ninety-Day Alignment

**Linked assets:** `PWR-01` Strategic North Star & Operating Mandate • `TPL-05` Strategy-on-a-Page & Ninety-Day Alignment Card • `strategic_mandate`  
**Trigger and intended benefit:** A new plan, annual cycle, leadership transition or conflict among priorities needs alignment.  
**Allowed inputs:** Exact entity/site, administrator hat, current approved mandate, public commitments, strategy version, constraints and named authority.

**Run sequence:**

1. Run CHART and label authority.
2. Separate approved, proposed and unknown commitments.
3. Map stakeholders, mission tensions and non-negotiables.
4. Select three outcome measures with owners.
5. Draft one bounded ninety-day alignment choice.
6. Route unresolved mandate questions to the named authority.

**Output contract:** Strategy-on-a-Page plus mandate ledger, measures and human questions. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Board, owner or executive sponsor accepts, revises or rejects the direction.  
**Stop and fallback:** Stop if the mandate, authority, entity or current source is missing or contradictory. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-02 — Executive Decision, Options, Pre-Mortem & Receipt

**Linked assets:** `PWR-02` Executive Decision, Options & Scenario Studio • `TPL-06` ALIGN Executive Decision, Options & Assumptions Brief • `decision_option_record`  
**Trigger and intended benefit:** A consequential choice needs a transparent decision brief.  
**Allowed inputs:** Decision question, owner, deadline, evidence, constraints, affected groups, options and required reviewers.

**Run sequence:**

1. Run CHART and ALIGN.
2. Define decision and non-decision boundaries.
3. Build status quo and at least two genuine alternatives.
4. Label facts, estimates, assumptions and unknowns.
5. Compare value, harm, equity, workforce, finance, reversibility and dependencies.
6. Run pre-mortem and define leading indicators.
7. Prepare recommendation for human consideration and empty decision receipt.

**Output contract:** Decision Brief, option matrix, assumption ledger, pre-mortem and receipt shell. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Named decision owner records accept, revise, defer or reject.  
**Stop and fallback:** Stop for missing owner, fabricated evidence, prohibited decision domain or unreviewed material risk. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-03 — Portfolio, Dependency, Capacity & Benefit Gate

**Linked assets:** `PWR-03` Portfolio, Initiative & Benefit-Realization Navigator • `TPL-07` Portfolio, Dependency, Capacity & Benefit Gate • `portfolio_initiative`  
**Trigger and intended benefit:** The initiative portfolio is overloaded, duplicative or unclear.  
**Allowed inputs:** Approved initiative list, charters, sponsors, resource envelopes, milestones, dependencies and benefit definitions.

**Run sequence:**

1. Normalize initiative IDs and lifecycle states.
2. Link every item to an approved mandate or label it unlinked.
3. Expose duplicates and upstream/downstream dependencies.
4. Compare demand with approved capacity using ranges.
5. Review benefit evidence, equity and burden.
6. Prepare continue, revise, pause and stop options for each sponsor gate.

**Output contract:** Portfolio Map, dependency network, capacity conflicts and benefit-realization queue. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Portfolio council or sponsors decide priority, funding and lifecycle state.  
**Stop and fallback:** Stop if hidden scoring, employee-level data or unauthorized financial detail is requested. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-04 — Board or Committee Brief, Agenda & Action Closure

**Linked assets:** `PWR-04` Board, Committee & Stakeholder Governance Navigator • `TPL-08` Board or Committee Brief, Conflict Prompts & Action Register • `governance_meeting_action`  
**Trigger and intended benefit:** A governance body needs a pre-read, decision structure or action follow-through.  
**Allowed inputs:** Body charter, agenda, decision rights, approved materials, quorum/conflict rules, prior actions and accessibility needs.

**Run sequence:**

1. Verify body and authority.
2. Classify items as decision, discussion or information.
3. Check source, confidentiality, conflict and missing evidence.
4. Draft concise pre-read and decision questions.
5. Prepare consent exceptions and dissent path.
6. Create action fields with human owner, due date and acknowledgment.
7. Reconcile only to the official record after human verification.

**Output contract:** Governance Brief, agenda, conflict prompts and unofficial action register. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Chair, secretary or counsel verifies official notice, decision and minutes.  
**Stop and fallback:** Stop if asked to invent a vote, quorum, conflict ruling, privileged content or official minutes. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-05 — Access, Demand, Capacity & Equity Brief

**Linked assets:** `PWR-05` Access, Demand & Capacity Intelligence Studio • `TPL-09` Access, Demand, Capacity & Equity Brief • `outcome_metric_registry`  
**Trigger and intended benefit:** Leaders need to understand access pressure or service demand using approved aggregates.  
**Allowed inputs:** Service, time window, approved aggregate dataset, measure definitions, access standards, owners and data-quality limits.

**Run sequence:**

1. Verify aggregation, minimum necessary and small-cell rules.
2. Define numerator, denominator, exclusions and time window.
3. Separate demand, available capacity, scheduled capacity and realized activity.
4. Segment only with approved valid groups.
5. Check variation, inequity and data-quality limits.
6. Prepare bottleneck hypotheses and human-authorized test options.

**Output contract:** Access & Capacity Brief, measure dictionary, equity questions and sponsor queue. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Operational and clinical owners validate measures and choose interventions.  
**Stop and fallback:** Stop for patient rows, scheduling action, triage, eligibility, utilization or safe-capacity conclusions. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-06 — Flow, Handoff, Constraint & Reversible-Test Lab

**Linked assets:** `PWR-06` Flow, Throughput, Handoffs & Bottleneck Lab • `TPL-10` Flow, Bottleneck, Handoff & PDSA Map • `process_improvement_record`  
**Trigger and intended benefit:** A hospital or clinic process has waits, handoff failures, rework or poor reliability.  
**Allowed inputs:** Approved process scope, start/end, roles, aggregate timestamps, dependencies, sponsor and human QI determination.

**Run sequence:**

1. Confirm project classification and sponsor.
2. Map current state and official systems.
3. Separate work, wait, rework and failure demand.
4. Identify constraint hypotheses without declaring cause.
5. Review safety, equity, accessibility and workforce burden.
6. Draft smallest reversible PDSA with measures and stop rule.
7. Route execution to named humans.

**Output contract:** Current-State Map, bottleneck hypotheses, PDSA draft and balancing measures. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Sponsor and accountable clinical/operational humans authorize and run the test.  
**Stop and fallback:** Stop for live care direction, patient movement, assignment, root-cause declaration or missing QI/research determination. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-07 — Daily Huddle, Seven Signals, Escalation & Closure

**Linked assets:** `PWR-07` Daily Management, Huddle & Escalation Decision Board • `TPL-11` Daily Huddle, Seven Signals & Escalation Board • `governance_meeting_action`  
**Trigger and intended benefit:** A tiered daily-management cycle needs a concise view and closed loops.  
**Allowed inputs:** Huddle tier, approved aggregate signals, thresholds, standard work, owners, escalation routes and review time.

**Run sequence:**

1. Verify this is not real-time emergency monitoring.
2. Show no more than seven attention items.
3. Label signal, source, freshness and uncertainty.
4. Assign only a named human owner.
5. Record decision needed, escalation route and due time.
6. Require acknowledgment and official reconciliation.
7. Close, escalate or expire every item at cycle end.

**Output contract:** Huddle Brief, seven-signal board, action/decision queue and closeout receipt. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Huddle leader confirms every status and official-system update.  
**Stop and fallback:** Stop for automated alerting, patient tracking, staff assignment, messaging or silent carry-forward. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-08 — Hospital, Clinic or Multi-Site Operating-Model Canvas

**Linked assets:** `PWR-08` Hospital, Clinic, Service & Site Operating-Model Designer • `TPL-12` Hospital, Clinic, Service or Multi-Site Operating-Model Canvas • `administrator_authority_profile`  
**Trigger and intended benefit:** A service, site or network needs clearer purpose, roles, decision rights and interfaces.  
**Allowed inputs:** Operating level, approved services, governance, roles, interfaces, enterprise standards, local variations and constraints.

**Run sequence:**

1. Define scope and service promise as approved or proposed.
2. Map accountable roles and decision rights.
3. Distinguish enterprise standard from local choice.
4. Map clinical-administrative, central-local and vendor interfaces.
5. Check equity, accessibility, burden, resilience and measurement.
6. Create exception and approval register.
7. Draft phased implementation questions.

**Output contract:** Operating-Model Canvas, decision-rights map, interface map and exception register. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Relevant governance, clinical, HR, finance, legal and operational owners approve.  
**Stop and fallback:** Stop if asked to enact reorganization, staffing, scope, closure, policy or service promise. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-09 — Budget, Forecast, Variance & Sensitivity Review

**Linked assets:** `PWR-09` Budget, Forecast, Variance & Resource-Stewardship Studio • `TPL-13` Budget, Forecast, Variance & Sensitivity Scenario • `financial_scenario`  
**Trigger and intended benefit:** A budget cycle, variance or investment decision needs transparent scenarios.  
**Allowed inputs:** Approved financial inputs, definitions, budget version, period, assumptions, finance owner and materiality threshold.

**Run sequence:**

1. Verify source, currency, units and period.
2. Separate actual, budget, forecast and estimate.
3. Reconcile calculation logic and document formulas.
4. Bridge variance into named drivers without causal overclaim.
5. Run base, upside and downside sensitivities.
6. Connect scenarios to mission, quality, equity and capacity.
7. Route accounting and resource decisions to finance.

**Output contract:** Budget Scenario, variance bridge, sensitivities and finance-question ledger. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Finance validates calculations and accountable leaders decide resources.  
**Stop and fallback:** Stop for transactions, journal entries, payroll, banking, pricing, statements or guaranteed savings. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-10 — Aggregate Revenue-Cycle, Denial & Contract Learning Review

**Linked assets:** `PWR-10` Revenue Cycle, Payer & Contract Learning Navigator • `TPL-14` Aggregate Revenue-Cycle, Denial & Contract-Question Brief • `revenue_procurement_learning`  
**Trigger and intended benefit:** An aggregate trend needs process learning and questions for authorized specialists.  
**Allowed inputs:** Approved aggregate metrics, definitions, contract/policy source authorized for use, time window and review owners.

**Run sequence:**

1. Verify no patient account or claim detail.
2. Define denominator and category logic.
3. Separate data-quality, workflow, training and contract questions.
4. Map aggregate process and failure categories.
5. Label all legal/coding/coverage interpretations as unresolved.
6. Prepare bounded improvement hypotheses and owner queue.

**Output contract:** Aggregate Revenue-Cycle Brief, category map, contract questions and process opportunities. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Revenue-cycle, coding, compliance, finance, payer-relations and legal humans decide.  
**Stop and fallback:** Stop for codes, claims, appeals, prior authorization, coverage, medical necessity, contract interpretation or payer communication. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-11 — Procurement, Vendor, Asset & Exit Due Diligence

**Linked assets:** `PWR-11` Procurement, Vendor, Asset & Sustainability Due-Diligence Studio • `TPL-15` Procurement, Vendor, Business Case & Exit-Risk Matrix • `revenue_procurement_learning`  
**Trigger and intended benefit:** A purchase, renewal or vendor selection needs an evidence-based business case.  
**Allowed inputs:** Approved need, requirements, alternatives, vendor claims, lifecycle costs, security/privacy evidence and procurement rules.

**Run sequence:**

1. Declare conflicts and reviewers.
2. Separate must-have requirements from preferences.
3. Mark vendor claims versus verified evidence.
4. Compare total cost, implementation burden and benefits.
5. Review safety, interoperability, accessibility, equity, cyber, data rights and sustainability.
6. Plan continuity, exit, export and decommissioning.
7. Prepare formal-review queue.

**Output contract:** Business Case, requirements matrix, vendor questions, risk-and-exit register. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Procurement, finance, legal, privacy, security and operational owners complete formal review.  
**Stop and fallback:** Stop for selection, negotiation, signature, purchase order, credentials, connection or endorsement. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-12 — Workforce Capacity, Workload & Skill-Mix Scenario

**Linked assets:** `PWR-12` Workforce Capacity, Workload & Skill-Mix Evidence Navigator • `TPL-17` Workforce Capacity, Workload & Skill-Mix Evidence Brief • `workforce_aggregate`  
**Trigger and intended benefit:** Leaders need an aggregate workforce picture and questions for formal governance.  
**Allowed inputs:** Approved aggregate workforce data, role groups, definitions, service demand, workload measure, time window and HR owner.

**Run sequence:**

1. Apply small-cell and minimum-necessary rules.
2. Separate headcount, FTE, productive hours, vacancies and competencies.
3. Validate workload numerator and denominator.
4. Model scenario ranges and seasonality.
5. Review workload, equity, safety and development questions.
6. Prepare governance options without declaring adequacy.

**Output contract:** Workforce Capacity Brief, definition ledger, scenario ranges and risk-question queue. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** HR, labor, finance, clinical and operational leaders decide staffing and employment matters.  
**Stop and fallback:** Stop for employee rows, scheduling, assignment, performance, discipline, credential inference or safe-staffing claims. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-13 — Psychological Safety, Listening Themes & Response Commitments

**Linked assets:** `PWR-13` Culture, Psychological Safety, Conflict & Listening Navigator • `TPL-18` Psychological Safety, Listening Themes & Response Commitments • `change_adoption_record`  
**Trigger and intended benefit:** A leader has voluntary input or authorized aggregate listening results to understand.  
**Allowed inputs:** Approved purpose, visibility rules, voluntary nonsensitive input or aggregate themes, audience, confidentiality limits and support routes.

**Run sequence:**

1. Publish who can see what.
2. Remove identifying detail and suppress small groups.
3. Separate source language, theme and interpretation.
4. Show uncertainty, disagreement and missing voices.
5. Identify urgent official routes without investigating.
6. Draft response options, owner commitments and feedback-back plan.

**Output contract:** Listening Synthesis, theme map, response commitments and follow-up loop. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** HR, compliance, labor, safety or other authorized humans handle cases and action.  
**Stop and fallback:** Stop for surveillance, identity/sentiment inference, retaliation scoring, investigation, fault or discipline. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-14 — Change Impact, Plain-Language Communication, Learning & Adoption Plan

**Linked assets:** `PWR-14` Change, Plain-Language Communication & Adoption Architect • `TPL-19` Change Impact, Communication, Learning & Adoption Plan • `change_adoption_record`  
**Trigger and intended benefit:** An approved or proposed change needs a humane implementation journey.  
**Allowed inputs:** Change scope, sponsor, decision status, affected groups, current/future state, channels, accessibility/language needs and support capacity.

**Run sequence:**

1. Label what is decided, proposed and unknown.
2. Map impacts and workflow changes by group.
3. Identify co-design and consultation needs.
4. Build accessible message set and messenger plan.
5. Run the human-voice/anti-slop check: keep source, owner, action, date and uncertainty; remove filler, fake warmth and unverifiable claims.
6. Create learning, support and feedback channels.
7. Select adoption and burden measures.
8. Define pause, revise and rollback triggers.

**Output contract:** Change Canvas, impact map, communications, learning plan and adoption measures. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Sponsor and authorized communications, HR, legal, clinical and operations owners approve.  
**Stop and fallback:** Stop for deceptive persuasion, fake consensus, hidden scoring, external send, policy enactment or launch. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-15 — Leadership Charter, Delegation, Succession & Protected Life

**Linked assets:** `PWR-15` Leadership, Delegation, Succession & Whole-Life Compass • `TPL-20` Leadership, Delegation, Succession & Growth Map • `whole_life_private`  
**Trigger and intended benefit:** An administrator wants clearer leadership practices, growth and whole-life boundaries.  
**Allowed inputs:** Private mission, values, active hat, professional commitments, development goals, succession concerns and protected-life needs.

**Run sequence:**

1. Verify personally controlled context for personal details.
2. Define leadership promise and non-goals.
3. Map decisions to retain, delegate, consult and escalate.
4. Identify development, sponsorship and succession questions.
5. Create Minimum Mode and recovery boundaries.
6. Choose one ninety-day growth experiment and delete/review date.

**Output contract:** Leadership Charter, delegation card, succession map and protected-life plan. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Administrator owns private choices; governance and HR own appointments and employment decisions.  
**Stop and fallback:** Stop if personal isolation is unproven or diagnosis, fitness, promotion promise, secret finance or hidden evaluation is requested. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-16 — Quality, Safety, Accreditation & Regulatory Readiness Crosswalk

**Linked assets:** `PWR-16` Quality, Safety, Accreditation & Regulatory-Readiness Navigator • `TPL-21` Quality, Safety, Accreditation & Regulatory Readiness Crosswalk • `quality_compliance_readiness`  
**Trigger and intended benefit:** A site or service needs to organize current requirements and evidence.  
**Allowed inputs:** Exact entity/site/service, official requirement source/version, local policy, evidence inventory, owners and review scope.

**Run sequence:**

1. Verify source applicability with named owner.
2. Separate law, regulation, standard, guidance and policy.
3. Parse requirements without changing meaning.
4. Map each to owner, control and evidence.
5. Label missing, stale, contradictory or insufficient evidence.
6. Draft mock questions and remediation options.
7. Set source-expiry watch.

**Output contract:** Readiness Crosswalk, evidence ledger, gap queue and mock-review prompts. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Compliance, accreditation, legal, quality and executive humans determine sufficiency and attest.  
**Stop and fallback:** Stop for guarantees, certifications, official submissions, concealment, altered records or invented evidence. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-17 — Policy, Control, Evidence & Exception Review

**Linked assets:** `PWR-17` Policy, Control, Compliance & Audit-Evidence Studio • `TPL-22` Policy, Control, Audit Evidence & Exception Matrix • `quality_compliance_readiness`  
**Trigger and intended benefit:** A policy or control needs drafting, crosswalk, evidence or exception governance.  
**Allowed inputs:** Approved purpose, authoritative sources, current policy/version, control/process owner, evidence location and review route.

**Run sequence:**

1. Separate requirement, interpretation, policy, procedure and practice.
2. Map control objective, activity, owner, frequency and evidence.
3. Compare current wording with source and practice.
4. Record conflicts and exceptions.
5. Draft redline with rationale and open questions.
6. Route approval, publication, retention and training to authorized humans.

**Output contract:** Policy Draft/Crosswalk, control matrix, evidence request and exception register. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Policy owner, counsel, compliance, records and governance approve and publish.  
**Stop and fallback:** Stop for legal advice, privilege claims, publication, audit opinion, evidence fabrication or regulator response. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-18 — Equity, Accessibility & Community Impact Review

**Linked assets:** `PWR-18` Equity, Accessibility, Patient/Family & Community Experience Lens • `TPL-23` Equity, Accessibility, Patient/Family & Community Impact Review • `equity_experience_review`  
**Trigger and intended benefit:** A decision, service or initiative needs an explicit people-and-rights lens.  
**Allowed inputs:** Decision/initiative, affected communities, approved aggregate experience data, accessibility/language requirements, commitments and engagement owner.

**Run sequence:**

1. Map who benefits, bears burden or is missing.
2. Validate denominators and small-cell protections.
3. Check accessible formats, language access and accommodation routes.
4. Examine distributional effects and digital access.
5. Invite human partnership at meaningful decision points.
6. Prepare mitigations, owners and feedback loop.

**Output contract:** Equity & Accessibility Review, missing-voice map, engagement plan and mitigations. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Civil-rights, accessibility, experience, community, clinical and legal owners review.  
**Stop and fallback:** Stop for protected-class inference, individual scoring, demographic targeting, token consultation or civil-rights conclusions. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-19 — Synthetic Emergency, Continuity & Downtime Exercise

**Linked assets:** `PWR-19` Emergency Preparedness, Business Continuity & Downtime Rehearsal • `TPL-24` Synthetic Emergency, Continuity & Downtime Exercise Plan • `resilience_cyber_risk`  
**Trigger and intended benefit:** A team needs to rehearse an approved plan without affecting live operations.  
**Allowed inputs:** Clearly synthetic scenario, approved current plans, facility/service, roles, dependencies, communication/recovery owners and facilitator.

**Run sequence:**

1. Display EXERCISE banner.
2. Verify official command structure and stop phrase.
3. Define objectives and essential functions.
4. Map people, facility, supply, technology and vendor dependencies.
5. Build injects, decisions, manual workarounds and accessibility checks.
6. Rehearse recovery and official reconciliation.
7. Facilitate after-action observations and owner-assigned improvements.

**Output contract:** Exercise Plan, inject deck, dependency map, recovery checklist and after-action draft. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Emergency management and incident-command humans own any exercise and all real events.  
**Stop and fallback:** Stop immediately for a real event, real-time monitoring, declaration, dispatch, mass message or clinical instruction. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-20 — Privacy, Cybersecurity & Third-Party Risk Intake

**Linked assets:** `PWR-20` Cybersecurity, Privacy & Third-Party Risk Navigator • `TPL-25` Privacy, Cybersecurity, Data-Flow & Third-Party Risk Intake • `resilience_cyber_risk`  
**Trigger and intended benefit:** A system, data flow, vendor or use case needs formal review preparation.  
**Allowed inputs:** System/use case, data classes, data flows, vendor/hosting facts, identity model, integrations, retention, controls and incident route.

**Run sequence:**

1. Identify owners and affected people.
2. Classify and minimize data with humans.
3. Map trust boundaries, subprocessors and destinations.
4. Check identity, access, logging, encryption, resilience and deletion.
5. Request vendor evidence without accepting claims.
6. Record gaps, compensating controls, incident and exit needs.
7. Route formal authorization.

**Output contract:** Privacy/Security Intake, data-flow map, evidence request and risk register. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Privacy, security, legal, compliance, procurement and system owners decide.  
**Stop and fallback:** Stop for scans, penetration tests, credentials, production access, legal determination, incident containment or authorization-to-operate. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-21 — Incident, Issue, Corrective Action & Closure Governance

**Linked assets:** `PWR-21` Incident, Issue, Corrective-Action & Learning System • `TPL-26` Incident, Issue, Corrective-Action & Official-System Boundary Card • `quality_compliance_readiness`  
**Trigger and intended benefit:** An authorized process needs a systems-focused issue brief and action governance.  
**Allowed inputs:** Synthetic scenario in Private mode or approved official-system context, issue owner, facts, policy, review body and immediate safety route.

**Run sequence:**

1. Route urgent safety and preserve official reporting first.
2. Keep Private mode synthetic and generic.
3. Separate facts, interpretations and hypotheses.
4. Map process conditions without declaring cause.
5. Prepare questions for authorized analysis.
6. Draft actions with owner, due date, measure and stop rule.
7. Define verification and closure evidence.

**Output contract:** Issue Brief, official-boundary card, action proposal and closure criteria. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Authorized safety, compliance, legal, HR, clinical and executive humans decide and close.  
**Stop and fallback:** Stop for real-event narrative in Private mode, autonomous report, blame, cause, privilege, discipline or regulator contact. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-22 — Digital & AI Use-Case Intake, Stage Gate & Retirement Plan

**Linked assets:** `PWR-22` Data, Digital & AI Use-Case Portfolio Governor • `TPL-27` Digital & AI Use-Case Intake, Stage Gate & Retirement Plan • `agent_charter_trace`  
**Trigger and intended benefit:** A proposed or existing digital/AI use case needs portfolio governance.  
**Allowed inputs:** Sponsor, problem, users/affected people, alternatives, data, model/vendor, integrations, decision impact, evidence, cost and lifecycle owner.

**Run sequence:**

1. Verify problem and non-AI alternatives.
2. Run CHART and ALIGN.
3. Classify data, decision impact and rights risk.
4. Define value and harm hypotheses with baselines.
5. Set evidence, security, privacy, accessibility and human-oversight gates.
6. Define monitoring, incident, material-change, renewal and exit rules.
7. Route stage decision to governance.

**Output contract:** AI Use-Case Card, risk-and-rights tier, evidence plan, stage gate and retirement obligations. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Cross-functional AI governance approves, rejects, pauses or retires each stage.  
**Stop and fallback:** Stop for shadow AI, production data, procurement, connector, deployment, high-impact automated decision or self-approval. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-23 — ORBIT Agent Charter, Permission & Human-Handoff Design

**Linked assets:** `PWR-23` AI Agent Charter, Tool, Permission & Human-Handoff Designer • `TPL-28` ORBIT Agent Charter, Permission & Human-Handoff Envelope • `agent_charter_trace`  
**Trigger and intended benefit:** A narrow agent concept needs a safe preview before any run.  
**Allowed inputs:** Objective, owner, beneficiary, affected people, data, sources, tools, destination, time/cost budget and human decision owner.

**Run sequence:**

1. Define objective and non-goals.
2. Assign risk and proposed maximum permission.
3. Minimize data/tools and prohibit destinations.
4. Design provenance, uncertainty and human handoff.
5. Create normal, failure, missing-source, injection, bias, security and recovery tests.
6. Set expiry, kill, rollback, purge and retirement.
7. Keep PERM-P0 until named-human one-run approval.

**Output contract:** ORBIT Charter, permission envelope, registry, tests and handoff map. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Named human approves one bounded run after independent review and passing evidence.  
**Stop and fallback:** Stop for clinical/HR/financial/identity/coverage/compliance decisions, production write, recursion, self-change or hidden persistence. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

### WF-24 — Agent Evaluation, Run Receipt, Incident & Retirement

**Linked assets:** `PWR-24` Agent Evaluation, Monitoring, Incident, Kill, Rollback & Retirement Controller • `TPL-29` Agent Test, Run, Human Decision, Incident & Retirement Receipt • `control_audit_receipt`  
**Trigger and intended benefit:** A chartered agent needs independent test, bounded supervision or safe removal.  
**Allowed inputs:** Approved charter, frozen version, test set, baseline, expected output, run owner, permission, logs, cost limit and incident route.

**Run sequence:**

1. Verify charter/version/permission.
2. Run tests in sandbox with synthetic or approved data.
3. Score usefulness, accuracy, provenance, bias, privacy, security and failure behavior.
4. Compare to baseline and inspect human edits.
5. Require named-human accept/reject before release.
6. On failure kill, contain, preserve evidence, rollback and purge.
7. Verify retirement and orphan cleanup.

**Output contract:** Evaluation Scorecard, run receipt, human decision, incident packet and retirement proof. Every output shows exact context/active hat, source/version, fact versus interpretation, uncertainty, human decision owner, allowed/prohibited use, expiry and correction/delete controls.  
**Human gate:** Independent named human or control function releases, kills, rolls back and retires.  
**Stop and fallback:** Stop for self-attestation, silent retry, permission increase, production release, evidence deletion or incident suppression. Use the named human and official procedure.  
**Completion receipt:** Record preview/run state, inputs accepted/rejected, CHART/ALIGN result, output reference, human accept/revise/reject, official reconciliation if any, end state, expiry, rollback/purge and no-background-work confirmation.

## Suggested software agents — all PERM-P0 Disabled

| ID | Agent | Narrow objective | Install state | Proposed maximum if separately approved |
|---|---|---|---|---|
| `AGT-01` | Source & Requirement Verifier | Verify publisher, exact title, version, status, applicability, conflicts and expiry for approved sources. | `PERM-P0 Disabled` | PERM-P2 approved read-only |
| `AGT-02` | Executive Brief & Scenario Drafter | Draft option-neutral decision briefs, assumption ledgers and pre-mortems from approved inputs. | `PERM-P0 Disabled` | PERM-P2 approved read-only |
| `AGT-03` | Portfolio & Dependency Mapper | Normalize approved initiative records and expose dependencies, capacity conflicts and missing owners. | `PERM-P0 Disabled` | PERM-P2 approved read-only |
| `AGT-04` | Access & Flow Aggregate Analyst | Analyze approved aggregates with measure definitions, small-cell rules, uncertainty and no patient rows. | `PERM-P0 Disabled` | PERM-P3 institution-approved read/sandbox |
| `AGT-05` | Financial Scenario Analyst | Calculate traceable non-transactional scenarios from finance-approved inputs and assumptions. | `PERM-P0 Disabled` | PERM-P3 institution-approved read/sandbox |
| `AGT-06` | Workforce Evidence Analyst | Analyze approved workforce aggregates without employee profiling, assignment or adequacy conclusions. | `PERM-P0 Disabled` | PERM-P3 institution-approved read/sandbox |
| `AGT-07` | Quality, Policy & Control Crosswalk Assistant | Map current requirements to approved policies, owners and evidence while leaving applicability and sufficiency to humans. | `PERM-P0 Disabled` | PERM-P3 institution-approved read/sandbox |
| `AGT-08` | Change, Accessibility & Communications Assistant | Draft accessible internal change materials and feedback plans without sending or publishing. | `PERM-P0 Disabled` | PERM-P2 approved read-only |
| `AGT-09` | Resilience Exercise Facilitator | Facilitate clearly synthetic continuity exercises and after-action drafts from approved plans. | `PERM-P0 Disabled` | PERM-P2 approved read-only |
| `AGT-10` | Independent Agent Auditor & Kill Sentinel | Evaluate frozen agents, surface violations and prepare kill/rollback/purge evidence; it cannot approve itself or other agents. | `PERM-P0 Disabled` | PERM-P2 separate control-plane read-only |

Every agent requires its own ORBIT charter, frozen version, independent tests, human decision/release owner, time and cost cap, expiry, manual fallback, incident route, kill, rollback, purge and retirement proof. Proposed maximum is not active permission. Agent 10 uses a separate control plane and cannot approve itself, modify permissions or serve as sole release evidence.

## Seven-day safe launch

1. **Day 1 — Orient:** verify lane isolation, exact role/hat, entity/site, CHART and permanent controls; preview no more than one private/synthetic power.
2. **Day 2 — Sources:** check one public or approved source record and expiry; make no regulatory or legal conclusion.
3. **Day 3 — Decide:** preview one low-risk decision or strategy card using fictional or nonsensitive information.
4. **Day 4 — Operate:** preview one aggregate or synthetic access/flow card; use no patient or employee row.
5. **Day 5 — People and resources:** preview one change, workforce-aggregate, resource or personal-leadership card in the proper isolated partition.
6. **Day 6 — Control:** inspect all power and agent states; test Pause All, Kill, rollback, export, delete and uninstall in preview.
7. **Day 7 — Review:** retain, revise, pause or remove each previewed capability; zero activated powers is a valid successful outcome.

Days 8–30: select at most three powers, one human owner per power, one measurable benefit and one burden/failure check. Days 31–90: scale only one evidence-bearing track after governance review. Re-run CHART, release checks and source watch after any material change.

## First safe use

Start in Private Administrator OS with public, administrator-owned nonsensitive or clearly synthetic information. Open My STEWARD, verify the exact active hat and one authority source, choose one Core Four launcher, preview one workflow, create one expiring artifact, accept/revise/delete it, and confirm no agent, connector, schedule, share or external action became active.
