Trueness enterprise operating system
25 October 2026. Proposed programme operations for one anchor client, its agencies and two Enterprise Audits. The research product has not been built. Automation handles preparation, routing and administration; named people own research design, contractual commitments and release. The calibration method and financial case govern scope and capacity.
Service boundaries
| Service | Contracted unit | Operating limit |
|---|---|---|
| Enterprise Audit | Audience × market × language × agreed task/instrument cell; $15k/cell, $75k floor, special scope quoted | 240 new sealed quantitative completes per cell; contextual interviews do not tune the tested system; six-to-eight weeks after readiness |
| Foundation programme | Three audiences in two markets, quarterly full waves | 1,200 completes per market in wave one, 960 subsequently; 12 initial interviews per cell; every record has its own tested task and expiry |
| Enterprise programme | Six audiences in four markets; quarterly or semiannual full waves specified in SOW | 150-person market-level pulses in intervening months screen drift; they do not renew all audience claims; cadence and capacity priced explicitly |
| Agency enablement/licence | Delegated client access or a separately contracted delivery licence | Access delegation is not a licence to sign records; licensees require method qualification, conflict review and a named external reviewer |
Programme service includes necessary model-change remediation/revalidation within the existing contracted scope. New audiences, markets or task families are change orders. A depleted internal reserve cannot turn an existing service obligation into an automatic upsell. Unsupported predictive use is paused while the agreed remedy is delivered. Paid work may legitimately produce failed or inconclusive findings.
Everyday exploratory Panel, Verdict, Challenge and Talk can continue where contract and data rights permit, with clear generated labels and scope status. A failed/expired quantitative record cannot appear as current validation. Ask the research preserves source citations and contradictions. Export preserves those distinctions.
Accountable roles and capacity
| Role | Accountability | Planning capacity |
|---|---|---|
| Venture/commercial lead | Executive selling, scope, entity contracts, budgets, escalations | Paid founder and commercial capacity in the model; no promise of a six-hour founder week |
| Programme research lead | Design, instruments, interpretation, agency enablement and QBR | Foundation 0.5 FTE/programme at $180k loaded/FTE; whole lead reserved at signature before service starts |
| External reviewer | Method, computation, claims and conflicts | Foundation ten days/year; larger cadence comparisons use 25/45 days, subject to measured need |
| Holdout custodian | Split assignment, sealed permissions, freeze manifests and release | Separate named role and access from model developers; cost allocated in delivery planning, not free labour |
| Audit research team | Frozen-system measurement across contracted cells | Seven-cell pilot audit: 180 research hours plus 5.5 reviewer days; additional to programme lead capacity |
| Engineering/operations | Tenant isolation, durable jobs, connectors, releases and incidents | Central platform build plus 0.2 delivery FTE per active reference programme; expanded scope separately costed |
| Client/channel manager | Agency onboarding, adoption, QBR logistics, usage and renewal | 0.2 FTE/reference programme; licensee support budgeted separately |
| Privacy/rights and finance owners | Rights, processor schedules, retention, commitments, close | Automated preparation plus accountable specialist approval |
Ten Foundation review days spread across 24 annual cell-wave records leave roughly 3.3 hours per record before common-method work. This is a constraint to measure, not proof of adequate scrutiny. Enterprise semiannual/quarterly comparisons budget 1.25/2.25 research FTE. Reserve actual hours by wave, record, language and deadline; a global FTE ratio cannot authorise unlimited simultaneous launches.
Claude and Codex support the venture. They are not legal partners, company officers or research signatories. Public anonymity does not remove the contracting entity's or responsible professionals' accountability to customers.
Standard operating procedures
| ID and trigger | Automated work | Accountable checkpoint | Completion evidence and exception |
|---|---|---|---|
| 01 Executive enquiry | Capture decision, sponsor, budget, existing systems and procurement dates | Commercial lead qualifies authority and testable value | Opportunity or reasoned no-fit; reply target one business day |
| 02 Scoped opportunity | Draft cell map, capacity plan, price and margin | Research/commercial leads approve exact scope and available slots | SOW, purchase order, credit/funding approval; no uncosted commitments |
| 03 Data intake | Provision client boundary, scan/hash/extract and propose rights register | Client and rights owner resolve permitted processing | Approved source inventory; quarantine unknown rights or foreign-client material |
| 04 Evidence mapping | Extract cited observations, derived claims and generated text separately | Research lead verifies decision-critical claims and gaps | Versioned evidence snapshot; contradictions remain visible |
| 05 Protocol lock | Draft instrument, split, estimands, tolerances, multiplicity and exposure design | Research lead and reviewer approve; custodian seals | Signed protocol plus prediction/stimulus hashes; revisions are new versions |
| 06 Fieldwork execution | Supplier orders within approval, quota monitoring, quality signals and invoice match | Researcher applies prespecified exclusions, never agreement with model | Clean dataset, dispositions and replacements; scarcity escalates before silent quota relaxation |
| 07 Audience development | Build from approved evidence; compare frozen candidate families and baselines | Researcher selects using development evidence only | Candidate manifest; no holdout-driven tuning |
| 08 Sealed evaluation | Execute locked outputs, release human targets under custody, calculate statistics in code | External reviewer examines own-build claims | Per-endpoint pass/fail/inconclusive; preserve every attempt and adverse result |
| 09 Record release | Draft record and exports; check completeness and status propagation | Research lead/reviewer sign within assigned remit | Immutable record and permitted-use set; no universal approval badge |
| 10 Panel request | Check client/agency grants, assets, complete stimulus processing, entitlements and cost | Preapproved routine exploratory jobs run without per-click researcher approval | Stable run ID, complete/partial manifest and clear status; quantitative claims need a matching current record |
| 11 Verdict and Challenge | Synthesis plus separately instructed critique; route contradictions | Research lead handles escalated claims; no automatic “agreement = valid” rule | Generated recommendation, unresolved objections, citations and safe next action |
| 12 Monitoring | Computational sentinels, source age, wave/pulse dates and restrictions | Lead distinguishes drift signal from human validation | Review/expiry actions; no significant drift is not proof of stability |
| 13 Support | Tenant-correct retrieval, ticket grouping and draft reply | Human handles research disputes and incidents | Resolution/cause log; one-business-day response target, negotiated severity cover |
| 14 Billing/collections | Contract milestones, invoice matching, reminders, reserve tracking | Finance approves refunds, changed payees and exceptional spend | AR/AP/commitment reconciliation; model assumes net60, no assumption deposits arrive at signature |
| 15 Renewal/offboarding | Prepare usefulness, evidence and spend history; revoke/delete on schedule | Client approves new term; rights owner signs deletion record | Annual decision, portable permitted export, revoked grants; never erase adverse records to win renewal |
| 16 Model-version change | Discover affected configurations/records, run sentinels and migration workflow | Research lead, reviewer and operator authorise release or restriction | See detailed procedure below; no silent substitution or unvalidated inherited label |
| 17 Incident | Stop affected processing, preserve redacted logs, isolate credentials and jobs | Incident owner determines recovery and required notifications with specialists | Containment, verified restoration, customer notice and corrective action |
| 18 Monthly close | Reconcile job/usage/invoice, prepaid fieldwork, WIP, revenue, labour and cash | Finance and venture leads review budget/forecast | P&L, cash, capacity and variance report; below-cost commitments require a funded decision |
| 19 Quarterly/full-wave planning | Build per-cell quota and stimulus matrix, quote comparisons, dates and manifests | Lead/custodian approve before supplier order | See wave procedure below; unresolved cell means reduced claim or funded boost |
| 20 Agency onboarding | Create scoped grants, training sandbox, connector invitation and adoption checklist | Brand owner delegates; agency admin verifies roster | See agency procedure below; no implied access to another brand or agency's drafts |
| 21 Executive quarterly review | Assemble usefulness, decisions, limits, changes, spend and next-wave options | Research lead signs evidence; commercial lead owns obligations | Client decision log and next-quarter plan; no unsupported ROI or statistical averaging |
| 22 Enterprise contracting | Draft MSA/SOW/DPA/security responses from approved templates and evidence | Legal/privacy/security/finance owners approve their commitments | Executed schedules and obligation register; questionnaire answers cannot claim unbuilt controls |
| 23 Licensee qualification and oversight | Track training, witnessed audit, conflicts, permissions, quality review and revenue share | Method owner qualifies scope; independent reviewer signs permitted records | Time-limited licence and audit trail; revoke release rights after material breach, preserve client access/records |
SOP 19: programme wave planning and procurement
Start six-to-eight weeks before the scheduled full-wave release. Confirm active audiences, markets/languages, tasks, exclusions, current configuration, decision tolerances and planned changes. The finance wave is a cash/capacity unit; method approval determines its actual sample.
- Produce the cell matrix: first-wave 160 development/240 sealed, later-wave 80/240, plus initial interviews and separately specified subgroup boosts. Identify overlapping memberships and unique respondent counts.
- Compare two supplier quotes where feasible. Specify incidence, translation, screen length, quality/replacements, processor terms and field dates. Obtain staged commitments before recruitment; finance checks cash against the net60 collection plan.
- Custodian assigns protected IDs and access. The supplier can return operational counts without exposing sealed answers. Confirm no previous development exposure contaminates the test.
- Lock version/stimulus bank, randomisation and analysis. Collect development evidence, freeze the candidate and predictions, then open prospective sealed outcomes only through the custodian.
- Researcher and reviewer adjudicate per-cell results. Publish all outcomes in the client record, update the registry, and reconcile supplier payments, prepaid balances and actual hours.
Targets assume four-to-six weeks preparation and two-to-three weeks field/QA, to be confirmed by market. Failed quotas trigger a funded extension, a narrower claim or an inconclusive record. Model-generated responses cannot fill the gap.
SOP 20: agency onboarding and client-controlled sharing
The brand owner approves each agency sub-tenant, users, audiences, source collections, task permissions, export rights and expiry. Agency administrators manage their own roster only. Internal agency work remains private to its permitted project until explicitly shared; the client contract defines the brand's oversight rights. No automatic cross-agency retrieval, shared memory or pooled embeddings.
Train on six actions using a synthetic demo corpus with no client data. A planner completes Panel → Verdict → Challenge → Export, identifies an unsupported use, then retrieves an authorised record through read-only MCP. Confirm a denied cross-brand/cross-agency request, revocation and expiring report link. Record training completion and support needs. Agency departure revokes memberships, tokens, scheduled jobs and source grants; immutable historical records remain under the agreed retention terms.
SOP 16: model-version change and included revalidation
Trigger: provider retirement, observed drift, prompt/tool/retrieval revision, changed output mapping, safety-policy change or proposed lower-cost model. Operator opens a change ticket identifying every affected audience/record and client commitment. Preserve the old version and outputs; pin versions where supported, never invent provider guarantees.
The research lead classifies impact with evidence. A presentational change that cannot alter inference may receive regression-only review. Any change capable of altering audience behaviour creates a new candidate; use development-only comparison, sealed future stimuli and appropriate fresh human confirmation. Previously opened holdouts may diagnose but cannot independently validate a tuned replacement.
During assessment, serve the supported old version or an already validated fallback. If unavailable, restrict the quantitative claim and offer labelled exploratory use where permitted. Notify affected clients and agencies with scope, alternatives and expected remedy; invalidate cached claim status and exports that imply current support while preserving original historical reports.
Release requires analysis, external review where relevant, new record/supersession links, regression/isolation checks and rollback evidence. Finance charges included-scope change work to its reserve and tracks overruns. Management funds a contractual shortfall or agrees a remedy; it cannot silently charge a new build or declare an untested replacement equivalent.
SOP 22: enterprise commercial readiness
Prepare an MSA and scope schedule with the legal party, audience-market-task cells, cadence, deliverables, roles, data rights, outcome-independent fees, payment milestones, acceptance, support and change remedies. Define generated reactions versus measured human findings, client ownership of records, vendor-access limits, conflicts, and consent for any publication separately.
Data schedules specify controller/processor roles as applicable, authorised processing and model providers, subprocessors, data location/transfers, retention/deletion, participant information, incident handling and raw-response access. Security responses describe implemented controls and dated evidence: SSO, least privilege, isolation, backups, tested restore, audit trails and connector revocation. An intended SOC 2 assessment is a project milestone; do not claim an attestation before it exists.
Agree client/agency delegation, source-sharing permissions, permitted exports, termination continuity and agency licence boundaries. Model-change revalidation within scope is an included obligation; scope expansion is explicitly priced. Credit review and funding approval precede supplier commitments. Professional advisers approve the actual legal terms; this checklist is an operating specification.
Automation, control and measurement
Use durable jobs, idempotency keys, structured inputs, source manifests, cost limits, retries with backoff and a single exception queue. A completed stage survives a later failure. Models draft/propose; application services enforce authorisation, claims, payments and state changes. Statistical code produces numerical results. Do not give research agents unrestricted payment, production database, holdout or cross-client search credentials.
Separate source data, respondent identities, sealed targets, commercial records and telemetry. Parse attachments in an isolated worker with size/type limits. Treat source text as evidence, never an instruction to tools. Credentials stay in managed secrets; logs contain identifiers and costs rather than raw interviews. Cache by client/grant/version, not just prompt text. Restores, deletion and breach recovery require recorded checks.
Monthly monitoring separates usefulness from validity: active seats by role/agency, Panel-to-action rate, repeated use, citations checked, human follow-ups, decisions logged, latency and support time; versus per-cell evidence status, expiry, drift, exclusions and effective bases. Financial monitoring includes fully loaded margin, committed fieldwork, cash receipts, reviewer capacity and model-change reserve. Track total human minutes per customer outcome—including exceptions—to test whether automation is actually reducing work.
Store every SOW, rights register, protocol, manifest, record, approval and invoice against programme/wave/market IDs using the record templates. NTFY carries coordination only, never customer evidence or credentials.