Factory Floor · 03
A number in front of
a decision-maker.
And the evidence under it.
Registers, exposure engines, portfolio views, board packs. Systems whose whole job is to be trusted at the moment someone has to act on them — which means they have to be able to show where every figure came from.
You hold: the production system, role-based views built around the decisions each role actually makes and period-over-period reporting that flags material change on its own.
The failure mode this class has
A dashboard that cannot show its working gets used once.
Decision-support systems fail in a specific way. They present a figure, someone senior asks where it came from, and the answer requires a data engineer and a week. From that point the tool is treated as indicative — which is a polite way of saying it is not used for decisions, which was the entire purpose.
So the discipline in this class is provenance. Every figure traces to the record that produced it. Where a number is genuinely unavailable, the system says so rather than filling in a plausible one. Citadel is our own instance of this pattern and its rule is explicit: a light is lit on a verified count, dark on a verified zero, and dashed when the feed is unavailable. Simulated evaluations are labelled as simulated and cannot be approved.
The second discipline is refusing to auto-fill judgement. An EU AI Act classification is a legal determination made by an accountable person. A system that guesses it and presents the guess in the same typeface as a measured fact has done something worse than nothing.
Risk and value on one record
The reason Citadel puts cost, expected benefit and risk tier on the same row is that it changes the conversation from a worry list to an accelerate-or-stop decision. Separating them — risk in one system, value in another — guarantees neither gets acted on.
How it runs
Provenance first, then presentation.
The pattern generalises well beyond AI governance — any domain where a board has to act on a figure someone will later challenge.
- EngagementProduction Build — 6–12 weeks
- MethodEvery figure traces to its record
- GateThe system never shows a number it cannot defend
- Reference buildCitadel — and Backgate on the same interface
- Research behind itEvidence Graph, in the Lab
Start from the decision, not the data
Which decision does this support, who makes it, how often, and what would change their mind. A tool built from available data outward becomes a report nobody reads.
Establish provenance rules
For every figure: its source record, its refresh cadence, and what the system displays when the source is unavailable. Unavailable is a state, not a zero.
Model the record properly
Risk and value on the same record where the decision needs both. The Evidence Graph research is where we work out how governance evidence behaves as a graph rather than a filing cabinet.
Build the views for real roles
A board view, a CFO view, a governance-lead workflow, an audit view, an operations register. Same record, different question — not the same table with columns hidden.
Make the reporting period-aware
A board pack that flags material change on its own, rather than requiring someone to diff two PDFs the night before the meeting.
The two lists that matter
What you hold, and what we will not do.
Both are in the engagement letter before you sign it. The second list is the one worth reading twice — it is where most disappointment in this market actually comes from.
What you hold at the end
- The production system, with provenance rules documented per figure
- Role-based views built around the decisions each role actually makes
- Period-over-period reporting that flags material change on its own
- The evaluation harness and monitoring, as with any build on this floor
- ADRs, runbooks and the rollback plan written before the work started
What we won’t do
- Dashboards that cannot show where a figure came from
- Auto-filled legal or regulatory determinations
- Coverage reported as a reassuring percentage
- Simulated results presented like measured ones
- Tools built from available data rather than from a decision
The proof it generalises
The same substrate runs a hardware shop.
Backgate is a shop, a workshop and a back office for a business of three staff, built on Citadel’s own interface and sold as a managed service. Governance tooling built to satisfy a regulated board, running a counter. That was the experiment, and it worked.
See all three products →Where the numbers come from
For an AI estate, Sentinel is the discovery engine that populates the record — exposure and opportunity priced in pounds, with the method stated.
Which decision is going unmade?
Thirty minutes with a founder. Tell us the figure nobody currently trusts, and we will tell you what it would take to make it defensible.
Fixed fee · Quoted in writing before we start · NDA available