PizarraContexto de trabajoDocumentos y registrosControles críticosRegistrosPreparaciónCondiciones bloqueantesAutorización
Aseguramiento / Técnico
PizarraContexto de trabajoDocumentos y registrosControles críticosRegistrosPreparaciónCondiciones bloqueantesAutorización
Aseguramiento / Técnico
Phase 4 rev.2 · enterprise option decision · platform-neutral

Enterprise Business / Architecture Option Decision

The capability was accepted at the Phase 3 Integrated Acceptance Gate. Technology is selected second. No option is preferred because it already exists, was used in the prototype, or is organizationally familiar. No frozen invariant is reopened and no Technical Solution Definition is started here.

A — Executive decision summary

Preferred: OPTION C — HYBRID / FEDERATED ENTERPRISE MODEL

Option C preserves every frozen invariant (no-compensation, single mastership per object, fail-closed degradation, evidence lineage, human authorization) while introducing the smallest new enterprise surface. Q4 remains authoritative for validated Control-of-Work objects; Aconex, P6, Smart Completions, HR/Training and Forwood remain authoritative for their own objects; only the integrated decision context — which no system owns today — is newly mastered, under ADR-14 Option C stewardship. Option A is not preferred because it requires Q4 to master data it does not own, which fails the uncontrolled-authority and master-duplication decision conditions regardless of its lower change load or apparent licence cost.

OPTION B is the credible fallback and is functionally equivalent; it differs from C only by owning more of the capability than the object authority map requires. If the enterprise cannot govern object-level authority across the estate, B is preferred over C.

Expressly not decided at this gate
  • · No product, vendor, licence or technology stack is selected by this recommendation.
  • · No cost figure is asserted; no validated cost baseline exists.
  • · No Technical Solution Definition is started. That requires a separate authorization.
  • · No frozen structural invariant from A–G, 0B, 0C, H–AE, ADR-14 or Section X is reopened.

Next decisionEnterprise Option Selection → Technical Solution Definition Authorization

HOLD — Technical Solution Definition has not begun and must not begin until the enterprise option is formally selected by the competent authority.

B — Option architecture shapes

Object-level authority across the existing estate (Q4, Smart Completions, Aconex, P6, HR/Training, Forwood). Only the minimum decision-context and orchestration capability is introduced; nothing is re-mastered that an existing system already masters well.

OBJECT AUTHORITY MAP (each object has exactly one master)
  Permits/Isolations -> Q4      Documents/Rev -> Aconex     Schedule -> P6
  Completions/ITR    -> SC      Competency    -> HR/Trng    CritCtrl -> Forwood
  Location register  -> Canonical Location Register (ADR-14 Option C, stewarded)
                                      |
                     +----------------v-----------------+
                     | MINIMAL DECISION-CONTEXT LAYER   |
                     | IRDE verdict + pinning + audit   |
                     | (no re-mastering, no shadow SoR) |
                     +----------------+-----------------+
                                      | verdict consumed by Q4 / field UX

Required option register

No weighted scoring is applied. No approved enterprise decision weights have been issued by a competent authority, so any numeric total would be an invented preference. Options are compared on qualified evidence per dimension and on the mandatory disqualification tests, which are pass/fail and cannot be offset by advantage elsewhere.

DimensionA — Extend Q4B — Q4 + ReadinessC — Hybrid federatedD — Alternative platform
CapabilityFitPARTIAL

Q4 natively supports safety documents, permits, isolations, competency checks at issue and work packs. Location Operational Context as a cumulative SIMOPS container, forecast readiness, PACE applicability composition and cross-source continuity are not native and require substantial customization outside Q4's transactional model.

STRONG

Full accepted capability set (Functional + Preventive Readiness, Location context, Job Cards, current/forecast, SIMOPS pairwise + cumulative, critical control, continuity, fail-closed, reconstruction) is implemented where it belongs — upstream of authorization — as demonstrated by the Phase 1/2/2A prototype evidence.

STRONG

Same functional coverage as B, with a deliberately smaller footprint: only IRDE verdict, decision pinning and location/SIMOPS context are new. Fit depends on each retained source exposing the attributes the ECE needs; unvalidated adapters are the residual gap.

PARTIAL

Any capable platform could in principle host the capability, but no evidence has been produced showing capability advantage over B or C; low-code hosts additionally strain under deterministic engine and evidence-lineage requirements.

AuthorityIntegrityWEAK

Forces Q4 to become de-facto master of location, competency, schedule and forecast data it does not own. That is silent parallel mastership — explicitly rejected by the decision conditions and by ADR-14 Option C.

STRONG

Q4 remains the single master of validated Control-of-Work objects; the readiness layer masters only integrated decision context and never writes authorization. Preserves 'System prepopulates, humans authorize'.

STRONG

Object-level authority is explicit and stewarded; the Canonical Location Register is the only new master and it is governed under ADR-14 Option C with named stewards.

WEAK

Most credible variants duplicate permit/competency/location masters or ambiguously overlap Q4's write authority. Cannot be recommended while that duplication is ungoverned.

IntegrationComplexityPARTIAL

Fewer endpoints for the field, but every source feed must be pushed into a vendor product on the vendor's terms; each feed becomes a supported customization and an upgrade liability.

PARTIAL

Highest number of read adapters (7+), but all are read-only and independently degradable. Adapter existence for Forwood, HR/Training and Smart Completions is NOT validated and is carried as an open dependency.

ADEQUATE

Same adapter surface as B, minus anything the minimal layer does not need. Complexity is bounded by the object authority map rather than by an ambition to centralize.

WEAK

Adds a new platform's integration and identity surface on top of the existing estate with no offsetting reduction.

OperationalFitPARTIAL

Single tool for the field is a genuine adoption advantage. But readiness latency is bound to Q4's transactional cadence, and workface planning / lookahead is not Q4's design intent.

STRONG

Purpose-built lookahead, shift and location-context journeys verified in Phase 2/2A; degraded mode and offline capture are designed in. Cost: two surfaces for supervisors unless embedded.

STRONG

Same operational behaviour, and the minimal layer can be surfaced inside existing tools, lowering the two-surface adoption penalty.

PARTIAL

Field usability unproven; would restart the Phase 1–2A verification cycle.

ControlIntegrityPARTIAL

Q4's own control model is sound, but no-compensation across non-Q4 dimensions (forecast, cumulative SIMOPS, cross-source gaps) would be implemented as customization, i.e. outside vendor-assured behaviour.

STRONG

Non-compensable STOP, fail-closed unmapped states, behavioural authority gating and evidence-bearing HUMAN_CONFIRMED records are demonstrated in Phase 2A closure evidence.

STRONG

Identical control semantics; the smaller code surface reduces the assurance burden of re-verifying control behaviour after each change.

PARTIAL

Deterministic no-compensation and evidence lineage are achievable but unproven on the candidate hosts; low-code platforms typically cannot guarantee deterministic evaluation ordering.

ResilienceWEAK

Single point of failure: if Q4 is unavailable, both authorization and readiness visibility are lost simultaneously.

STRONG

Readiness layer degrades to HOLD/UNRESOLVED on source failure without blocking Q4's own authorization path; source failure is a fail-closed input, not an outage.

STRONG

Failure is isolated per object master; the decision layer withholds a verdict rather than guessing.

PARTIAL

Depends entirely on the chosen platform's SLA; no evidence available.

DataGovernanceWEAK

Data ownership becomes implicit inside a vendor product; export and reconstruction depend on vendor data model stability.

ADEQUATE

Explicit contracts and pinned decision snapshots; the readiness store holds derived context, not duplicated masters — but its retention and lineage policy must be formally issued.

STRONG

Object authority map makes governance auditable by construction; the only new governed dataset is the Canonical Location Register.

WEAK

New governance regime for a new estate, with duplication risk.

LifecycleCostPARTIAL

Lowest apparent licence delta, offset by vendor customization rates and recurring re-certification of customizations at every Q4 upgrade. No verified vendor quotation exists; no cost figure is asserted.

PARTIAL

Highest build and run cost of the three credible options: a full capability to develop, host, support and evolve, plus 7+ adapters to maintain. No cost figure is asserted.

ADEQUATE

Lowest total lifecycle exposure of the credible options on qualitative evidence: minimal new build, no re-mastering, reuse of existing licensed estate. Not quantified — no validated cost baseline exists.

WEAK

New licences, new build, new support, plus migration of what already works.

TechnicalDebtWEAK

Customization debt accrues inside a vendor product — the least controllable form of debt, and it compounds at every upgrade.

PARTIAL

Owned debt: modifiable, but the full capability plus adapter estate must be carried indefinitely.

ADEQUATE

Smallest owned surface; existing systems continue to be maintained by their existing owners under existing contracts.

WEAK

Debt of a parallel estate plus the debt of what it fails to replace.

ScalabilityPARTIAL

Scales where Q4 is deployed; projects and JVs without Q4 cannot use the capability at all.

STRONG

Source-agnostic by construction; a project with different sources needs new adapters, not a new capability.

STRONG

Same source-agnostic scaling, with the lowest per-project onboarding cost because the layer is thin.

PARTIAL

Scales only as far as the new platform's licensing and deployment model allows.

ChangeImpactADEQUATE

Lowest surface change for users already in Q4 — the one clear advantage of Option A.

WEAK

New tool, new roles, new stewardship, new daily rituals; requires funded organizational change (P3-TRN-01).

PARTIAL

Moderate: new stewardship roles and a new decision ritual, but users largely stay in the tools they know.

WEAK

Maximum change: new platform plus migration plus retraining.

C — Capability-to-option fit matrix

Accepted capabilityABCDEvidence note
Functional Readiness (scope, materials, access, permits, schedule)ADEQUATESTRONGSTRONGPARTIALQ4 sees permits and work packs, but not P6 float, Aconex revision state or completions status without new feeds.
Preventive Readiness (PACE applicability & composition)PARTIALSTRONGSTRONGPARTIALComposition of the preventive package from hazard × task × location × equipment is not a Q4 native construct.
Location Operational Context (canonical register, inheritance)WEAKSTRONGSTRONGPARTIALADR-14 Option C requires a federated canonical register with stewardship; embedding it in Q4 creates a shadow master.
Job Cards as the decision contextADEQUATESTRONGSTRONGPARTIALQ4 work packs are close but transactional; the job card must aggregate non-Q4 sources.
Current + Forecast Readiness (weather, competency expiry, document expiry)WEAKSTRONGSTRONGPARTIALForecast is a planning-horizon construct; Q4 evaluates at issue time, not across a lookahead window.
SIMOPS pairwise + cumulative (CUM-1…CUM-7)WEAKSTRONGSTRONGPARTIALCumulative evaluation across concurrent job cards at one location has no Q4 equivalent.
Critical Risk / Critical Control verificationPARTIALSTRONGSTRONGPARTIALRequires Forwood (or equivalent) integration in every option; adapter not yet validated.
Discipline continuity across shifts and handoversWEAKSTRONGSTRONGPARTIALContinuity spans permits, personnel and location state simultaneously.
Fail-closed behaviour on unmapped / missing source statePARTIALSTRONGSTRONGPARTIALPhase 0C determinism must hold for all sources, not only the host platform's own data.
Evidence reconstruction of any past decisionPARTIALSTRONGSTRONGWEAKRequires pinned versions of every consumed input, including those mastered elsewhere.

D — Authority / system-of-record comparison

Any option requiring a silent parallel master is rejected on that basis alone.

ObjectMaster todayOption AOption BOption CRisk
Permit to Work / Isolation / Safety DocumentQ4Q4 (unchanged)Q4 (unchanged) — readiness layer reads onlyQ4 (unchanged)None in A/B/C. Option D risks displacing an assured authorization record.
Engineering document + revision stateAconexCopied into Q4 → shadow masterAconex, pinned by version at decision timeAconex, pinned by version at decision timeVersion pinning is mandatory; a copied revision that drifts silently invalidates every past decision.
Schedule / lookahead windowP6Copied into Q4 → shadow masterP6P6Duplicated schedule masters produce contradictory lookaheads between planning and field.
Competency / training / medical fitnessHR / Training / HealthQ4 holds its own competency lists → duplication (already a known Q4 pattern)HR/Training remains master; Q4 competency use is reconciled, not replacedHR/Training remains master; explicit reconciliation contractThis duplication exists today and must be governed under CA-03 in whichever option is selected.
Critical control verificationForwood (or equivalent)Feed into Q4ForwoodForwoodAdapter not validated in any option — open dependency, not an option discriminator.
Location canonical identity + operational contextNone (fragmented across systems)Q4 becomes de-facto master — not its roleCanonical Location Register inside the readiness capability, stewardedCanonical Location Register as a governed federated register, stewardedADR-14 Option C requires named stewardship; unstaffed stewardship ⇒ AuthorityResolutionState = UNRESOLVED, capabilities DISABLED_SAFE.
Integrated readiness verdict + pinned decision snapshotNoneQ4 (mixed with transactional records)Readiness capabilityMinimal decision-context layerMust never be writable by a source system, and must never itself authorize work.

Critical decision conditions (pass/fail — cannot be offset)

TestABCD
Weakens no-compensationNo — but the rule would be implemented as customization, weakening its assurance.NoNoUnproven on candidate hosts
Creates uncontrolled authorityYes — Q4 becomes de-facto master of location, schedule and competency context it does not own.NoNoLikely
Requires non-governed master duplicationYesNoNoLikely
Cannot preserve evidence lineagePartially — lineage to non-Q4 sources depends on copies rather than pinned source versions.NoNoUnproven
Cannot operate safely under source failureQ4 outage removes both authorization and readiness simultaneously.No — degrades fail-closedNo — degrades fail-closedUnproven

H — Open ADR / dependency treatment

No unresolved decision is hidden inside the recommendation. Each remains visible and owned.

DependencyQuestionABCBlocking status
ADR-03Canonical identity + semantic reconciliation across sourcesResolved implicitly by absorbing everything into Q4 — i.e. resolved by duplication, which is not acceptable.Must be resolved explicitly as part of the readiness capability's contract set.Resolved by the object authority map; this option forces the answer into the open rather than hiding it.Must be resolved as part of the selected enterprise option (Phase 3 condition).
ADR-13 / CA-01Legal/regulatory status and binding of an authorization recordQ4 already carries the record; binding question narrows but does not disappear.Q4 remains the authorization record holder; readiness records are advisory and must be labelled as such.Same as B, with explicit object-level statement of which record is legally operative.Must be resolved before any real (non-synthetic) authorization record is created — all options.
ADR-15…24Controlled open architecture decisionsSeveral become vendor-constrained rather than enterprise-decided.Remain enterprise-decidable and visible.Remain enterprise-decidable and visible.Visibility must be retained in all options (Phase 3 condition); Option A degrades that visibility.
CA-03Competency mastership duplicationWorsens: Q4 competency lists become the operative set.Addressed by reconciliation contract; duplication remains until closed.Addressed by the object authority map with a named master.Closure required as part of the selected enterprise option.
CA-04Cross-source gap attribution and ownership of remediationAttribution collapses into 'Q4 says no' with weak upstream traceability.Fully attributable — demonstrated in Phase 2A F-02 closure.Fully attributable via the object authority map.Not gating for option selection; gating for solution definition.
OfflineAuthorizationDeterministic offline capture and reconciliation without stale authorizationBounded by Q4's own offline model; unverified for readiness context.Designed for: offline captures, never authorizes against stale context (CF-03).Same as B, with a smaller offline payload.Deterministic offline reconciliation must be demonstrated before implementation — all options.
Stewardship staffing (ADR-14)Are location and SIMOPS stewards named and funded?Still required; Q4 does not supply governance roles.Required; capability enforces DISABLED_SAFE when vacant (G-01).Required; same enforcement.Mandatory in all options. Not an option discriminator — it is an organizational precondition.
Organizational changeIs adoption funded and led?Lowest change load.Highest change load.Moderate change load.Must be funded before implementation (Phase 3 condition).
Enterprise IAM bindingAuthority and delegation bound to enterprise identityQ4 IAM binding; delegation model may not match ADR-14 stewardship.Must bind to enterprise IAM; currently prototype-session only.Must bind to enterprise IAM; currently prototype-session only.Gating for implementation in all options (P3 High finding).

I — Residual risk comparison

P4-R-01ALL OPTIONSHIGH

Adapter availability for Forwood, HR/Training and Smart Completions is asserted, not validated. No API has been confirmed.

TreatmentIntegration feasibility spike per source before Technical Solution Definition. Any source without a validated read path is carried as fail-closed (HOLD), never assumed available.

P4-R-02OPTION AHIGH

Vendor extension of Q4 would place mandatory control logic under vendor release control.

TreatmentNot accepted; contributes to Option A not being preferred.

P4-R-03OPTION BMEDIUM

A separately-built capability could drift from Q4's evolving CoW semantics, producing readiness verdicts based on stale assumptions about permit states.

TreatmentVersioned interface contract with Q4 state mapping; unmapped Q4 state ⇒ fail-closed (already demonstrated in the Q4-unmapped scenario).

P4-R-04OPTION CMEDIUM

The 'minimal' layer in Option C erodes over time into a de-facto second platform if scope is not governed.

TreatmentObject authority map is a controlled artefact; any proposal to master a new object in the decision layer requires design-authority approval.

P4-R-05ALL OPTIONSMEDIUM

No validated cost baseline exists for any option. Economics are qualitative only.

TreatmentCosted business case required as an input to Technical Solution Definition Authorization. No cost or saving is invented at this gate.

P4-R-06ALL OPTIONSHIGH

Stewardship roles remain unstaffed; capability enters DISABLED_SAFE and delivers no operational value.

TreatmentPhase 3 mandatory condition; organizational commitment required before implementation start.

J — Preferred option, across the full enterprise lifecycle

Why Option C works — every accepted capability is delivered, each object keeps exactly one governed master, degradation is fail-closed per source, and evidence lineage is reconstructible because decisions pin source versions rather than copies.

Why it is preferable over the alternatives — it delivers the same functional and control outcome as Option B with the smallest new enterprise surface, the lowest owned technical debt, no vendor release dependency on mandatory control logic, and the ability to onboard projects whose source estate differs. It reuses the licensed estate instead of displacing it, and it forces the open architecture decisions (ADR-03, CA-03) into an explicit object authority map rather than resolving them by silent duplication.

K — Why the other options are not preferred

Option A — Extend Q4

Fails two mandatory decision conditions: it creates uncontrolled authority and requires non-governed master duplication (location, schedule, competency). It also places non-compensation logic under vendor release control and couples authorization availability to readiness availability. Its genuine advantages — lowest change load, single field tool, existing licences — cannot offset a pass/fail condition.

Option B — Q4 + Readiness capability

Not rejected; architecturally sound and the credible fallback. It is not preferred only because it owns more capability than the object authority map requires, carrying higher build, run, adoption and lifecycle cost for no additional control or capability benefit over C.

Option D — Alternative platform

No evidence in the accepted baseline demonstrates material advantage over A, B or C. It adds a new estate, new integration and identity surface, migration of systems that already work, and duplication risk. It is retained in the register only as a tested and rejected alternative, not for completeness.

Rev.2 · A — Executive option decision summary

PHASE 4 REV.2 — ACCEPT (2026-08-30). Option C selected as governing Enterprise Option; Option B controlled fallback (explicit architecture decision required to move C→B); A and D rejected under non-compensable §18. Phase 5 Technical Solution Definition requires separate disposition — no API, database, deployment, pilot, or live integration authorized.

Selected: Option C — Hybrid / Federated Enterprise Model

Option B — Q4 + Integrated Readiness Capability, retained as a live fallback contingent on mapping-stewardship staffing

Critical decision interpretation (permanent record)

Option C is not selected for greater functional capability: Option B and Option C are materially capability-equivalent. Option C is preferred because its federation model provides a structurally stronger enterprise lifecycle position — the added federation burden is accepted only because it improves AuthorityIntegrity, SourceOwnershipPreservation, EnterpriseScalability, Cross-SystemDecisionContext, and ArchitectureFlexibility. No implementation team may silently simplify Option C into Option B.

Controlled open dependencies

Preserved as Controlled Open (Option C selection closes none): ADR-03; ADR-13 / CA-01; ADR-15…24; CA-03; CA-04; OfflineAuthorization; ADR-14 stewardship staffing; P3-TRN-01 organizational change.

Why it works

Every accepted capability is delivered, each object retains exactly one governed master, degradation is fail-closed per source, authority is enforced server-side across all six verbs, and evidence is reconstructible because decisions pin source versions rather than copies.

Why it preserves the operating model

Location remains the context container and never the authorizer; SIMOPS is evaluated cumulatively across concurrent job cards; functional and preventive readiness stay non-compensable; the system prepopulates and humans authorize.

Why the authority model is defensible

The object authority map is an explicit deliverable rather than an emergent property. No silent parallel master is created, and unresolved mappings fail closed instead of resolving to the most recent value.

Why it is technically plausible

It requires read-dominant reference integration and one verdict reference back to the transactional authority. It does not require a canonical master to be invented beyond the ADR-14 location register already authorized.

Why preferable across the lifecycle

Same capability and control outcome as B with the smallest owned logic surface, the lowest owned technical debt, no vendor release dependency on mandatory control logic, localized failure, and project onboarding as a mapping exercise rather than capability rework.

Expressly not decided
  • · No platform, product, vendor or licence model is selected.
  • · No API, database, middleware, cloud service or deployment technology is chosen.
  • · No cost, effort or schedule figure is asserted.
  • · No ADR is closed by this recommendation.
  • · No pilot or live integration is authorized.

B — Capability fit matrix (classified)

"Possible to customize" is not equated with "architecturally suitable".

CapabilityA — Extend Q4B — Q4 + ReadinessC — Hybrid federatedD — Alt platformEvidence note
WorkDemandEXTENSION_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTENSION_REQUIREDDemand originates upstream of Control-of-Work; no evidenced native demand object in the CoW estate.
JobCardNATIVENATIVENATIVEEXTENSION_REQUIREDJob Card / work item exists natively in the transactional estate; readiness layer references, never re-masters it.
WorkPackageCONFIGURABLECONFIGURABLECONFIGURABLEEXTENSION_REQUIREDIWP/WorkPackage is mastered in planning/completions systems; CoW consumes it as reference.
Location Operational ContextNOT_CREDIBLY_SUPPORTEDEXTERNAL_CAPABILITY_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTENSION_REQUIREDADR-14 Option C requires a stewarded canonical location register with cumulative context; no evidenced native equivalent.
Functional Enabling ConditionsEXTENSION_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTENSION_REQUIREDECE spans documents, schedule, completions and engineering state — outside any single platform's governed objects.
Preventive Applicability (PACE)NOT_CREDIBLY_SUPPORTEDEXTERNAL_CAPABILITY_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTENSION_REQUIREDApplicability/composition over cross-source attributes is not a Control-of-Work function.
IPERCCONFIGURABLECONFIGURABLECONFIGURABLEEXTENSION_REQUIREDRisk-assessment registers exist natively; continuity/reassessment triggers require external decision context.
PETAR / Work ControlNATIVENATIVENATIVEEXTENSION_REQUIREDHigh-risk permit routing is the native strength of the CoW platform and must remain there.
Critical ControlEXTENSION_REQUIREDCONFIGURABLECONFIGURABLEEXTENSION_REQUIREDCritical-control verification is mastered in the CCM estate (Forwood or equivalent); mapping only.
CurrentReadinessEXTENSION_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTENSION_REQUIREDDeterministic non-compensable verdict over federated inputs; must sit where all inputs are visible.
ForecastReadinessNOT_CREDIBLY_SUPPORTEDEXTERNAL_CAPABILITY_REQUIREDEXTERNAL_CAPABILITY_REQUIREDNOT_CREDIBLY_SUPPORTEDForecast requires validity horizons, expiry projection and environmental prediction; no evidenced native support.
SIMOPS (pairwise + cumulative)NOT_CREDIBLY_SUPPORTEDEXTERNAL_CAPABILITY_REQUIREDEXTERNAL_CAPABILITY_REQUIREDNOT_CREDIBLY_SUPPORTEDCUM-1…7 are cumulative location-scoped rules across concurrent job cards, not per-permit checks.
Location Continuity (Section X)NOT_CREDIBLY_SUPPORTEDEXTERNAL_CAPABILITY_REQUIREDEXTERNAL_CAPABILITY_REQUIREDNOT_CREDIBLY_SUPPORTEDContinuity across shift/discipline handover is a decision-context property, not a permit property.
Change / ReassessmentEXTENSION_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTENSION_REQUIREDSelective vs broad reassessment depends on pinned source versions held by the decision layer.
AssuranceEXTENSION_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTENSION_REQUIREDCross-source assurance cannot be produced by a system that sees only its own objects.
Evidence ReconstructionEXTENSION_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTERNAL_CAPABILITY_REQUIREDEXTENSION_REQUIREDSource → version → rule → decision → validation → authorization chain must be pinned at decision time.

C — Object-level authority comparison

ObjectMaster todayABCDNote
ControlledDocumentAconexDUPLICATEDFEDERATEDPRESERVEDDUPLICATEDRevision authority must never leave the document system; A copies revisions into CoW.
RequirementEngineering / spec estateUNRESOLVEDFEDERATEDFEDERATEDUNRESOLVEDRequirement mastership is an open enterprise question (CA-03).
P6ActivityP6DUPLICATEDFEDERATEDPRESERVEDDUPLICATEDSchedule dates re-keyed into CoW create silent divergence.
WBSP6 / Project ControlsDUPLICATEDFEDERATEDPRESERVEDDUPLICATEDSame divergence class as P6Activity.
IWPSmart Completions / BCSToolsDUPLICATEDFEDERATEDPRESERVEDDUPLICATEDIWP composition is a completions function.
WorkPackagePlanning / completionsDUPLICATEDFEDERATEDPRESERVEDDUPLICATEDReadiness layer holds a projection keyed to the master, never a rival record.
JobCardWork management / CoWPRESERVEDPRESERVEDPRESERVEDDUPLICATEDAll credible options keep the job card where execution happens.
LocationNone — ADR-14 canonical register requiredUNCONTROLLEDFEDERATEDFEDERATEDUNCONTROLLEDA and D make the platform an unstewarded de-facto location master.
EquipmentAsset / engineering registerDUPLICATEDFEDERATEDPRESERVEDDUPLICATEDTag authority stays with the asset register.
PersonHR / IAMDUPLICATEDFEDERATEDPRESERVEDDUPLICATEDLocal person records in CoW drift from HR terminations.
CompetencyTraining systemDUPLICATEDFEDERATEDPRESERVEDDUPLICATEDExpiry must be read from the training master or declared UNVERIFIABLE.
FitnessHealthUNCONTROLLEDFEDERATEDFEDERATEDUNCONTROLLEDHealth data requires purpose-bound federation, never copy.
RestrictionHealth / HRUNCONTROLLEDFEDERATEDFEDERATEDUNCONTROLLEDRestrictions govern assignment eligibility; copy is both stale and a privacy exposure.
RiskAssessmentCoW / IPERC registerPRESERVEDPRESERVEDPRESERVEDDUPLICATEDStays transactional in all credible options.
CriticalControlCCM (Forwood or equivalent)DUPLICATEDFEDERATEDPRESERVEDDUPLICATEDVerification events are owned by the CCM estate.
PermitQ4PRESERVEDPRESERVEDPRESERVEDDUPLICATEDAuthorization must remain in one transactional authority.
PETARQ4PRESERVEDPRESERVEDPRESERVEDDUPLICATEDAs permit.
IsolationQ4PRESERVEDPRESERVEDPRESERVEDDUPLICATEDAs permit.
SanctionToTestQ4PRESERVEDPRESERVEDPRESERVEDDUPLICATEDAs permit.
TemporaryModificationEngineering / MOCUNRESOLVEDFEDERATEDFEDERATEDUNRESOLVEDMOC mastership remains an open enterprise decision.
ReadinessDecisionNone — new objectUNCONTROLLEDPRESERVEDPRESERVEDUNCONTROLLEDNew governed object; must be mastered by the readiness capability with pinned inputs.
EvidenceEventNone — new objectUNCONTROLLEDPRESERVEDPRESERVEDUNCONTROLLEDImmutable evidence including denied attempts.
Mandatory pass/fail rule

Any option requiring UNCONTROLLED authority or material DUPLICATED MASTER to function is structurally unacceptable unless a competent enterprise authority explicitly redesigns that ownership model. Lower cost, faster deployment or organizational familiarity cannot compensate.

  • · A — FAIL — 5 UNCONTROLLED and 11 DUPLICATED masters are load-bearing, not incidental.
  • · B — PASS — no UNCONTROLLED pattern; duplication avoided by read-only federation.
  • · C — PASS — every object keeps exactly one governed master; new objects are explicitly mastered.
  • · D — FAIL — reproduces A's pattern while adding a migration of systems that already work.

D — Federation / identity viability

Federated keyA — Extend Q4B — Q4 + ReadinessC — Hybrid federatedD — Alt platformCommon-key availability
Project_IDLocal re-keyMapped, stewardedMapped, stewardedFull re-key on migrationPresent in most sources, inconsistent format
Location_IDInvented inside platform, unstewardedCanonical register, stewardedCanonical register, stewardedInvented inside platformNo common key today (ADR-14 gap)
Equipment_IDLocal copyMapped with conflict queueMapped with conflict queueMigrated copyTag exists; format varies by discipline
P6_Activity_IDRe-keyed manuallyDirect referenceDirect referenceRe-keyedStable in P6
WBS_IDRe-keyed manuallyDirect referenceDirect referenceRe-keyedStable in P6
IWP_NOFree-text fieldDirect referenceDirect referenceMigratedStable in completions
WorkPackage_IDPlatform-localMapped projectionMapped projectionPlatform-localVaries by project
JobCard_IDNativeNative + referencedNative + referencedMigratedOwned by work management
Person_IDLocal user listIAM-federatedIAM-federatedLocal user listHR/IAM authoritative
Common key

No enterprise common key exists today for Location. Nothing in this phase invents a canonical master; ADR-14 Option C already authorizes a stewarded canonical Location register, and that is the only new register assumed.

Mapping stewardship

Options B and C require named mapping stewards per source (Phase 3 residual P3-EA-01). A and D assume mapping is a technical import, which is exactly how unresolved mappings enter operational decisions.

Conflict handling

Unresolved or conflicting mappings must fail closed (UNVERIFIABLE → HOLD), never resolve to the most recent value.

Versioning

Mappings are versioned and effective-dated so a historical decision resolves against the mapping in force at decision time.

Multi-project separation

Project scoping is mandatory: identical tags across projects must not collide.

ADR-13 / CA-01 impact per option
  • · A — OPTION_DEPENDENT_RISK — resolves ADR-13/CA-01 by fiat inside one platform, which is the failure mode CA-01 was raised against.
  • · B — ENTERPRISE_DECISION_REQUIRED — forces the mapping authority question into the open and requires a named steward.
  • · C — ENTERPRISE_DECISION_REQUIRED — same, plus an explicit object authority map as a deliverable.
  • · D — OPTION_DEPENDENT_RISK — migration hides the mapping decision inside a data conversion.

E — Integration viability map

No API is assumed to exist. Where no interface is evidenced, the option carries the cost of establishing one, and the affected inputs are treated as UNVERIFIABLE until an interface is proven. Counts of interfaces are comparable only within the same dependency class: a read/reference dependency is not equivalent to a write or transactional dependency.

SystemDependency classABCDWhy
Q4 (Control of Work)Transactional + eventLOWHIGHMODERATEVERY_HIGHB needs bi-directional prepopulate/verdict exchange; C consumes state and returns a verdict reference only; D must replace it.
AconexRead / reference + version pinningHIGHMODERATEMODERATEHIGHRevision-level pinning is required; A additionally has to store copies it must then keep current.
P6Read / referenceHIGHMODERATEMODERATEHIGHSchedule windows drive forecast; read-only reference is sufficient for B and C.
Smart Completions / BCSToolsRead / referenceHIGHMODERATEMODERATEVERY_HIGHITR/IWP completion state feeds functional enabling conditions.
Engineering systemsRead / referenceVERY_HIGHHIGHHIGHVERY_HIGHHeterogeneous estate; no assumed API. Treated as evidence-bearing reference only.
HR / RRLLRead / referenceHIGHMODERATEMODERATEHIGHPerson, assignment and restriction data; privacy-bounded projection only.
TrainingRead / referenceHIGHMODERATEMODERATEHIGHCompetency validity and expiry horizon for forecast.
HealthRead / reference (purpose-bound)VERY_HIGHHIGHHIGHVERY_HIGHFitness/restriction must be consumed as eligibility flags, never as clinical data.
Forwood or equivalent CCMRead / eventHIGHMODERATEMODERATEHIGHCritical-control verification events; mapping to job card scope is the hard part, not transport.
IAMTransactional (authN/authZ claims)MODERATEMODERATEMODERATEHIGHServer-side authority enforcement depends on it in every option; Phase 3 gating action.
AnalyticsRead (derived)LOWLOWLOWMODERATEConsumes decisions; never a source of authority.

F — Authority enforcement comparison

Capability verbA — Extend Q4B — Q4 + ReadinessC — Hybrid federatedD — Alt platform
CanViewRole-based, platform-nativeServer-side, IAM-claimsServer-side, IAM-claimsPlatform-native
CanProposeNot distinguished from approve in evidenced configurationDistinct verb, enforced in decision layerDistinct verb, enforced in decision layerNot evidenced
CanValidateApproximated by workflow stepDistinct, attributableDistinct, attributableNot evidenced
CanApproveNativeNative in Q4Native in Q4Requires build
CanAuthorizeNativeNative in Q4Native in Q4Requires build
CanAdministerNative but coarseSplit: rule admin ≠ transaction adminSplit: rule admin ≠ transaction adminRequires build
Role × Area × Activity × Shift × Risk × RegisterTypeNot credibly supported without extension; risk of collapse to role-onlySupported by design as an ABAC decisionSupported by design as an ABAC decisionNot demonstrated

UI hiding is not authority enforcement. Phase 2A already demonstrated behavioural denial with sideEffect = NONE and a recorded denied-attempt event; any option that can only restrict at the presentation layer is flagged. Option A is flagged on the six-dimensional ABAC test; Option D is flagged as not demonstrated.

G — Offline / resilience comparison

OptionCaptureDecisionAuthorizationReconciliationVerdict
OPTION ACREDIBLE WITH DEPENDENCYOffline decision would be computed against platform-local copies — the copies are the stale riskStructurally tempting to allow, because the platform is also the authorization authorityConflict detection limited to objects the platform mastersHIGH RISK
OPTION BCREDIBLEDecision recomputed on reconnect against pinned source versionsNever offline — authorization stays a Q4 online transactionImmutable pending events, explicit recovery verificationCREDIBLE WITH DEPENDENCY
OPTION CCREDIBLESame as B; decision layer holds the pinNever offline — same rulePer-source reconciliation with per-source staleness stateCREDIBLE WITH DEPENDENCY
OPTION DNOT DEMONSTRATEDNo evidence in the accepted baselineNo evidenceNo evidenceNOT DEMONSTRATED
Fail-closed / resilience testA — Extend Q4B — Q4 + ReadinessC — Hybrid federatedD — Alt platform
CURRENT / STALE / UNVERIFIABLE preserved per sourceCollapses to one platform availability statePreserved per sourcePreserved per sourceNot demonstrated
Mandatory input missing → HOLDPossible but bypassable by the copy that is still presentEnforcedEnforcedNot demonstrated
Authority unresolved → DISABLED_SAFENot evidencedEnforced (G-01 demonstrated)Enforced (G-01 demonstrated)Not demonstrated
Technology failure never becomes operational authorizationAt risk — readiness and authorization share one availability envelopeHeld — separate envelopesHeld — separate envelopes per sourceNot demonstrated
Silent stale-data use for critical decisionsStructurally possibleRejected by designRejected by designNot demonstrated

H — Rule / configuration governance comparison

Rule setA — Extend Q4B — Q4 + ReadinessC — Hybrid federatedD — Alt platform
ApplicabilityVendor-release coupledGoverned in readiness capabilityGoverned in readiness capabilityVendor-release coupled
Frequencies / validityPartially configurableVersioned, effective-datedVersioned, effective-datedUnknown
Q4 state mappingsImplicit — no mapping objectExplicit, versioned, fail-closed on unmappedExplicit, versioned, fail-closed on unmappedN/A — new state model
No-compensation classificationsUnder vendor release controlUnder project governanceUnder project governanceUnknown
SIMOPS CUM-1…7Not credibly supportedConfigurable, approved, versionedConfigurable, approved, versionedNot demonstrated
Inheritance (context, never authorization)Risk of inheriting authorization with contextExplicit separationExplicit separationNot demonstrated
Authority rulesCoarse role modelABAC, versionedABAC, versionedNot demonstrated
Critical-control mappingsLocal copyMapped to CCM masterMapped to CCM masterLocal copy

ADR-16 (rule/configuration governance) is REQUIRES_PHASE_5 under B and C: both make rules first-class governed artefacts — versioned, project-scoped, approved, effective-dated and auditable — but neither designs the rule engine here. Under A, ADR-16 becomes OPTION_DEPENDENT_RISK because mandatory control logic sits inside vendor release cycles, so project-scoped effective-dating cannot be guaranteed. Under D it is CONTROLLED_OPEN with no evidence.

I — Evidence / reconstruction comparison

Reconstruction aspectA — Extend Q4B — Q4 + ReadinessC — Hybrid federatedD — Alt platform
Source → version pinning at decision timeCopies, not pins — the copy can be overwrittenPinned reference to source versionPinned reference to source versionNot demonstrated
Rule version recorded with decisionNot evidencedRecordedRecordedNot demonstrated
Decision explanation (which input drove the verdict)PartialFull, per-conditionFull, per-conditionNot demonstrated
Human validation attribution (who, role, when, context)Native for permits onlyFull across readiness and authorizationFull across readiness and authorizationNot demonstrated
Denied-attempt evidenceNot evidencedRecorded (Phase 2A F-05)Recorded (Phase 2A F-05)Not demonstrated
Immutable historical baseline reconstructionCompromised by mutable copiesCredibleCredibleNot demonstrated

J — Operational fit

Operational aspectA — Extend Q4B — Q4 + ReadinessC — Hybrid federatedD — Alt platform
Field usabilityBest — one tool, already adoptedTwo surfaces; field still authorizes in Q4Two surfaces; verdict surfaced inside the field toolNew tool, full re-adoption
Superintendent decision clarityPermit-centric, not location-centricLocation-centric readiness viewLocation-centric readiness viewNot demonstrated
Lookahead useWeak — no forecast objectStrongStrongNot demonstrated
Location contextNot credibly supportedSupportedSupportedNot demonstrated
Multi-discipline concurrent workPer-permit view onlySupportedSupportedNot demonstrated
SIMOPS cumulativeNot credibly supportedSupportedSupportedNot demonstrated
Blocker ownershipOwnership implicit in workflow stepExplicit owner + action + evidence refExplicit owner + action + evidence refNot demonstrated
ForecastNot credibly supportedSupportedSupportedNot demonstrated
Continuity across handoverNot credibly supportedSupportedSupportedNot demonstrated
Change / reassessment scope controlBroad reassessment onlySelective, version-drivenSelective, version-drivenNot demonstrated

Option A forces operations to adapt to the software structure: the operating model becomes permit-centric because that is what the platform masters. Options B and C preserve the accepted location- and readiness-centric operating model. Option D forces adaptation to an unevidenced structure and additionally discards adoption already achieved.

K — Supportability / technical-debt preview

DimensionA — Extend Q4B — Q4 + ReadinessC — Hybrid federatedD — Alt platform
CustomizationBurdenVERY_HIGH — core control logic becomes customizationMODERATE — logic in a purpose-built capabilityMODERATE — smallest owned surface of the credible optionsVERY_HIGH
IntegrationBurdenHIGH — every source must be imported, not referencedHIGH — full source set plus bi-directional Q4MODERATE/HIGH — full source set, read-dominantVERY_HIGH
ConfigurationBurdenMODERATEHIGH — rules are first-class and must be governedHIGH — same, plus the object authority mapHIGH
VendorDependencyVERY_HIGH — mandatory control logic under vendor release controlMODERATELOW/MODERATEVERY_HIGH
UpgradeRiskVERY_HIGH — customization vs upgrade path conflictMODERATEMODERATEHIGH
SupportComplexityMODERATE — one platform to supportHIGH — two governed surfacesHIGH — two surfaces plus federation adaptersVERY_HIGH
SpecialistSkillDependencyHIGH — vendor specialistsHIGH — internal capability teamHIGH — internal capability team plus mapping stewardsVERY_HIGH
ArchitectureDriftRiskVERY_HIGH — every unmet need becomes another local masterMODERATE — boundary must be actively policedMODERATE — object authority map is the controlHIGH

Qualitative only. No verified quantitative cost, effort or licence evidence exists in the accepted baseline, so no monetary values are manufactured. Note honestly: A has the lowest support complexity of all options — one platform, one support contract — and that advantage is real. It simply cannot offset a pass/fail authority failure.

L — Organizational / change impact

Change aspectA — Extend Q4B — Q4 + ReadinessC — Hybrid federatedD — Alt platform
Stewardship staffing (ADR-14)Unstaffed and unacknowledged — worst caseRequired and explicitRequired and explicit, plus mapping stewards per sourceRequired, unspecified
New decision rightsFew new rights; existing rights silently widenedPropose/validate/authorize split must be socializedSame, plus object authority ownership per sourceFull redefinition
Configuration ownershipVendor + platform adminProject rule governance body requiredProject rule governance body requiredUnknown
User adoptionLowest — familiar toolModerate — second surface for supervisorsModerate — verdict surfaced in the existing tool reduces the deltaHighest — full replacement
Field changeMinimalModerateModerateSevere
TrainingIncrementalNew readiness concepts + rolesNew readiness concepts + rolesComplete re-training
Governance overheadUnderstated — governance moves to vendor cyclesExplicit and ongoingExplicit and ongoingExplicit and largest
Bypass / workaround riskHIGH — a permit-centric tool invites offline readiness spreadsheetsMODERATE — two surfaces invite short-cutting the upstream oneMODERATE — mitigated by surfacing the verdict where work is authorizedHIGH

Phase 3 finding P3-TRN-01 (organizational change load) is carried forward unchanged and is NOT closed by any option. B and C both require a funded change programme, named stewards and a governance body before implementation. Neither is presented as low risk: their adoption model is the largest non-technical exposure in this decision, and C's advantage over B on adoption is marginal, not decisive.

M — Open ADR treatment matrix

ADR / CAQuestionABCDNote
ADR-03Requirement / engineering mastership boundaryOPTION_DEPENDENT_RISKENTERPRISE_DECISION_REQUIREDENTERPRISE_DECISION_REQUIREDOPTION_DEPENDENT_RISKA and D resolve it by absorption, which is not a decision.
ADR-13 / CA-01Federated identity and mapping authorityOPTION_DEPENDENT_RISKENTERPRISE_DECISION_REQUIREDENTERPRISE_DECISION_REQUIREDOPTION_DEPENDENT_RISKMapping stewardship must be named; no option closes it.
ADR-15Decision pinning and baseline immutabilityCONTROLLED_OPENREQUIRES_PHASE_5REQUIRES_PHASE_5CONTROLLED_OPENMechanism is Phase 5; the obligation is accepted now.
ADR-16Rule and configuration governanceOPTION_DEPENDENT_RISKREQUIRES_PHASE_5REQUIRES_PHASE_5CONTROLLED_OPENSee ADR-16 impact statement.
ADR-17…24Remaining structural decisionsCONTROLLED_OPENREQUIRES_PHASE_5REQUIRES_PHASE_5CONTROLLED_OPENCarried visibly; none is made easier-therefore-closed.
CA-03Object mastership closure across the estateOPTION_DEPENDENT_RISKENTERPRISE_DECISION_REQUIREDENTERPRISE_DECISION_REQUIREDOPTION_DEPENDENT_RISKC makes the map an explicit deliverable; it still needs an enterprise owner.
CA-04Cross-source assurance obligationsCONTROLLED_OPENREQUIRES_PHASE_5REQUIRES_PHASE_5CONTROLLED_OPEN
OfflineAuthorizationInterim rule: offline never authorizesOPTION_DEPENDENT_RISKCONTROLLED_OPENCONTROLLED_OPENCONTROLLED_OPENInterim rule stands under every option; A is flagged because the structure invites relaxing it.
ADR-14 StewardshipWho staffs location stewardshipENTERPRISE_DECISION_REQUIREDENTERPRISE_DECISION_REQUIREDENTERPRISE_DECISION_REQUIREDENTERPRISE_DECISION_REQUIREDUnresolved in all options; fail-closed behaviour (G-01) is the interim control.
OrganizationalChangeAdoption, training and governance loadOPTION_DEPENDENT_RISKENTERPRISE_DECISION_REQUIREDENTERPRISE_DECISION_REQUIREDOPTION_DEPENDENT_RISKP3-TRN-01 carried; funding decision required.

No ADR is marked closed because an option makes it easier.

N — Option C vs Option B pre-escape test

CriterionOption BOption CAdvantageMaterial?
CapabilityCoverageFull — the capability owns readiness end to endFull — identical accepted capability setNEUTRALnot material
AuthorityClarityClear, but the readiness capability holds more objects than it mustClearer — an explicit object authority map is a deliverable, one master per objectCMATERIAL
IntegrationCountSame source set, plus a bi-directional transactional link to Q4Same source set, read-dominant, one verdict reference backCnot material
CrossSystemDecisionCapabilityFullFullNEUTRALnot material
CustomLogicLarger owned logic surface (composition, projection, some re-mastering)Smallest owned logic surface consistent with the capabilityCMATERIAL
FailureDependenciesReadiness depends on the capability plus Q4 availabilityPer-source degradation states; failure is localizedCMATERIAL
SupportBurdenTwo governed surfacesTwo governed surfaces plus federation adapters and mapping stewardsBMATERIAL
TechnicalDebtModerate; grows if the capability keeps absorbing objectsLower owned debt; debt shifts to mapping governanceCMATERIAL
EnterpriseScalabilityOnboarding a project with a different source estate needs capability reworkOnboarding is a mapping exercise against the authority mapCMATERIAL
ChangeImpactSecond surface for supervisorsVerdict surfaced in the tool already used; marginally lower deltaCnot material
Is Option C's additional federation / orchestration burden justified by material capability advantage over Option B?

Qualified yes — but not on capability.

On capability coverage and cross-system decision capability the two options are equivalent; C offers no capability advantage and must not be selected on that basis. C's justification is structural: a smaller owned logic surface, localized per-source failure, an explicit one-master-per-object map, and project onboarding as a mapping exercise rather than capability rework. Those are material lifecycle advantages. Against them, C carries a genuine and non-trivial penalty — federation adapters and named mapping stewards per source, which is a staffing dependency, not a build item. The judgement is that C's federation burden is justified because that burden purchases authority clarity that B achieves only by owning more, and owning more is precisely the debt this programme is trying not to accrue. If the mapping stewardship cannot be staffed, C's advantage disappears and Option B becomes the correct selection — which is why B is retained as a live fallback, not a courtesy.

P / Q — Preferred option and why each alternative was not selected

P — Selected: Option C — Hybrid / Federated Enterprise Model

Same capability and control outcome as B with the smallest owned logic surface, the lowest owned technical debt, no vendor release dependency on mandatory control logic, localized failure, and project onboarding as a mapping exercise rather than capability rework.

Q — Option B not selected (retained)

Architecturally sound and functionally equivalent. Not selected only because it owns more capability than the object authority map requires, carrying higher owned logic, debt and lifecycle cost for no control benefit over C. It remains a live fallback if mapping stewardship cannot be staffed.

Q — Option A rejected

Fails non-compensable §18 conditions: uncontrolled authority, material duplicated masters, authority not enforceable beyond role/UI on the six-dimensional test, and evidence reconstruction compromised by mutable copies. Its genuine advantages — lowest change load, one field tool, existing licences — cannot offset a pass/fail failure.

Q — Option D rejected

No evidenced enterprise capability advantage exists in the accepted baseline. It reproduces Option A's authority pattern after a migration of systems that already work, without A's adoption advantage. Retained in the register only as a tested and rejected alternative.

S — Phase 4 decision assurance register

OPTION AExtend Q4REJECT
CapabilityFit 5 capabilities NOT_CREDIBLY_SUPPORTED (location context, PACE, forecast, SIMOPS cumulative, continuity)
AuthorityIntegrity FAIL — 5 UNCONTROLLED, 11 DUPLICATED masters, load-bearing
FederationViability Weak — mapping resolved by fiat inside the platform
IntegrationViability HIGH to VERY_HIGH — every source imported rather than referenced
AuthorityEnforcement Flagged — six-dimensional ABAC not credibly supported
OfflineViability HIGH RISK — decision computed against local copies
Resilience Single availability envelope for readiness and authorization
EvidenceIntegrity Compromised — mutable copies instead of source-version pins
OperationalFit Best field usability; forces a permit-centric operating model
Supportability Lowest support complexity; highest vendor dependency and upgrade risk
ChangeImpact Lowest adoption load; highest bypass risk
OpenDependencies ADR-03, 13/CA-01, 16, CA-03, OfflineAuthorization all OPTION_DEPENDENT_RISK
ResidualRisk Uncontrolled authority normalized into daily operations
PassFailCondition FAILS §18: uncontrolled authority; uncontrolled master duplication; cannot enforce authority outside UI; evidence reconstruction compromised
OPTION BQ4 + Integrated Readiness CapabilityRETAIN AS FALLBACK
CapabilityFit All capabilities credibly supported; readiness set is EXTERNAL_CAPABILITY_REQUIRED by design
AuthorityIntegrity PASS — no UNCONTROLLED pattern; federation avoids duplication
FederationViability Credible with named mapping stewardship
IntegrationViability HIGH — full source set plus bi-directional Q4 transaction
AuthorityEnforcement Server-side ABAC across all six verbs; demonstrated in Phase 2A
OfflineViability CREDIBLE WITH DEPENDENCY — offline never authorizes
Resilience Per-source CURRENT/STALE/UNVERIFIABLE preserved
EvidenceIntegrity Credible — source-version pinning, rule version, denied attempts
OperationalFit Preserves the accepted operating model; second surface for supervisors
Supportability Moderate customization, high configuration governance, moderate vendor dependency
ChangeImpact Funded change programme required; P3-TRN-01 open
OpenDependencies ADR-15, 16, 17…24, CA-04 REQUIRES_PHASE_5; ADR-03, 13/CA-01, CA-03, stewardship ENTERPRISE_DECISION_REQUIRED
ResidualRisk Capability scope creep — absorbing objects it need not master
PassFailCondition PASSES all §18 conditions
OPTION CHybrid / federated enterprise modelSELECT
CapabilityFit All capabilities credibly supported with the smallest new owned surface
AuthorityIntegrity PASS — exactly one governed master per object; new objects explicitly mastered
FederationViability Credible; requires named mapping stewards per source
IntegrationViability MODERATE to HIGH — read-dominant, one verdict reference returned
AuthorityEnforcement Server-side ABAC across all six verbs; demonstrated in Phase 2A
OfflineViability CREDIBLE WITH DEPENDENCY — offline never authorizes
Resilience Per-source degradation; failure localized to the affected source
EvidenceIntegrity Credible — decisions pin source versions rather than copies
OperationalFit Preserves the accepted operating model; verdict surfaced where work is authorized
Supportability Smallest owned logic surface; debt shifts to mapping governance
ChangeImpact Funded change programme plus mapping stewardship staffing; P3-TRN-01 open
OpenDependencies Same as B, plus the object authority map as an explicit enterprise deliverable
ResidualRisk Mapping stewardship cannot be staffed — if realized, fall back to Option B
PassFailCondition PASSES all §18 conditions
OPTION DAlternative enterprise platformREJECT
CapabilityFit Not demonstrated — no evidenced enterprise capability advantage in the accepted baseline
AuthorityIntegrity FAIL — reproduces A's pattern after migration
FederationViability Not demonstrated
IntegrationViability VERY_HIGH — new estate, new identity surface, migration of working systems
AuthorityEnforcement Not demonstrated
OfflineViability NOT DEMONSTRATED
Resilience Not demonstrated
EvidenceIntegrity Not demonstrated
OperationalFit Full re-adoption; discards adoption already achieved
Supportability Highest across every dimension
ChangeImpact Severe field change and complete re-training
OpenDependencies All CONTROLLED_OPEN or OPTION_DEPENDENT_RISK
ResidualRisk Programme-scale migration risk for no evidenced benefit
PassFailCondition FAILS §18 on the same conditions as A, without A's adoption advantage

R — Required competent decision authority

  • · Enterprise Architecture — object authority map and federation model
  • · Digital / IT-IM — integration and identity ownership
  • · ES&H — non-compensation and critical-control integrity
  • · Construction / Commissioning — operating-model fit
  • · Project Controls — schedule and completions source authority
  • · Transformation / Change — adoption and stewardship staffing (P3-TRN-01)
  • · Project Management — funding and mandate

HOLD POINT — no Technical Solution Definition, API design, database design, physical deployment architecture, pilot or live integration. Next hold point: Enterprise Option Selection → Technical Solution Definition Authorization.

Technology does not create readiness — it makes readiness visible, verifiable and traceable. Integration does not transfer accountability. Application access is not operational authority. Presentation familiarity does not create source authority. Synthetic demonstration data only.