HOTL Operations · Human-on-the-Loop Control Model
How human-on-the-loop governance runs the command center: autonomous execution, tiered approval gates and a 500 000 SEK circuit breaker.
111 departments · 10-tier matrix · 500 000 SEK breaker
The operating loop
1 · Autonomous execution
Daemons scout targets, draft outreach, reconcile settlements and publish media without waiting for a human keystroke. The operator observes rather than dispatches.
2 · Tiered approval gates
Every mutation is risk-scored. Low-risk work commits directly; IT-tier changes queue for engineering sign-off; founder-tier changes require an explicit sovereign approval with signature.
3 · Circuit breaker
Any single capital movement above 500 000 SEK halts the graph edge that produced it, freezes downstream sectors and escalates to the founder channel until manually released.
4 · Evidence & rollback
Each run writes an immutable revision entry with a diff, integrity hash and delivery receipt. Failed or reverted runs roll back automatically and mail a report to the operator.
Guardrails
- Dry-run first
- Simulation diffs render before any live write, exportable as JSON or PDF.
- Least privilege
- Tier L0–L9 role gating; investor seats are read-only and secrets stay masked.
- SLA monitoring
- Ingress, mail rail and settlement webhooks are scored against SLA thresholds with incident grouping.
- Escalation policy
- Breaches page the founder over telephony and email before autonomy resumes.
The 10-tier authority matrix
Authority is a gate evaluated before capability, and it never self-upgrades. An actor runs at a tier from L0 to L9; every action declares the tier it requires, and the gate allows it only when the actor meets or exceeds that level. Capital-moving tiers start at L6 with simulated orders — live money is unreachable below it — and L9 is bound to a founder BankID signature.
| Tier | Role | Mandate | Capital |
|---|---|---|---|
| L0 | Observer | Read-only telemetry surface | no |
| L1 | Analyst | Research and synthesis, no artifacts | no |
| L2 | Drafter | Draft memos, plans and offers | no |
| L3 | Local Tooling | Local tool execution, sandboxed | no |
| L4 | Repo Builder | Issue-scoped repository edits | no |
| L5 | Sandbox Factory | Air-gapped compile and fuzz | no |
| L6 | Paper Capital | Simulated capital, zero live orders | yes |
| L7 | Supervised Runtime | Runtime ops under observation | yes |
| L8 | Approval-Gated Ops | Operations requiring independent release review | yes |
| L9 | Founder Sovereign | Sovereign command · BankID bound | yes |
How the 500 000 SEK circuit breaker works
Every settlement, payout and transfer is evaluated against a single hard ceiling before it is committed. When one movement exceeds 500 000 SEK the breaker trips: the graph edge that produced the movement is halted, the sectors downstream of it are frozen so no dependent job can continue on stale capital state, and the run escalates to the founder channel. Autonomy does not resume on a timer — the operator releases the breaker manually, and the trip, the release and the diff between them are written to the immutable revision log.
Grounded in 111 departments
The loop is not abstract governance — it is applied to a ledger of 111 departments grouped into 13 autonomous pillars. Each department carries its own required tier and the operational lever it protects, so a breach is always attributable to a named sector rather than to "the system".
- Build6
- Capital8
- Commercial13
- Data10
- Governance8
- Infrastructure16
- Intelligence10
- Labs3
- Ops8
- Product6
- Security12
- Trading9
- Venture2
Where this runs in the command center
Why human-on-the-loop, not in-the-loop
Human-in-the-loop systems stall on every step because a person must approve each action. Human-on-the-loop inverts the default: the system executes continuously and the operator supervises exceptions. Throughput stays autonomous while accountability, capital limits and reversibility remain firmly human-controlled.