oversight-protocol — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oversight-protocol (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Level 0 — Automated
Scope: Daily SignalMonitor runs, event schema validation, churn score calculation
Gate: None — no PM interaction required
Log: Written to KG if Supabase connected
Level 1 — Advisory
Scope: Experiment design, feature prioritisation, pricing recommendation, OKR cascade
Gate: No approval required
Override: PM can type OVERRIDE: [reason] within 24 hours
Log: Override logged to KG if Supabase connected
Agents: LaunchPad (readiness audit), PriceLogic, UXLayer, RoadMap, NorthStar (OKR cascade)
Level 2 — Approval Required (blocking)
Scope: Pricing changes to existing customers, segment pivot, feature deprecation, ethics clearance
Gate: Orchestrator pauses; PM must type APPROVE / DECLINE / MODIFY
Timeout: 48-hour window; reminder sent at 24 hours; workflow holds indefinitely until response
Agents: DecideWell, GrowthIQ (financial incentives), OpsCommand (board deck / crisis comms)
Level 3 — Governance Approval (elevated)
Scope: AI feature ethics clearance, platform policy changes, third-party data sharing, bias audit failure
Gate: Named person from sign_off_required_by must respond; PM cannot self-approve Level 3
Timeout: 72-hour window; DataLayer blocks the action if no response
Agents: DataLayer exclusivelyWhen an oversight gate is reached, the Orchestrator pauses and displays:
[LUMEN] Approval Required · Level [N]
Workflow: [workflow name]
Decision: [what is being decided — one line]
Recommended: [agent name] — [recommended action, one sentence]
Evidence: [2-4 key values from context, separated by ·]
Evidence Quality: [HIGH / MEDIUM / LOW — reason in one clause]
Options considered: [n]
Key risk: [pre-mortem top risk — one sentence]
Options:
APPROVE — [what happens if approved]
DECLINE — [what happens if declined]
MODIFY: [instructions] — [which agent re-evaluates with PM instructions]
Expires: [48 hours (Level 2) / 72 hours (Level 3)]APPROVE
approveddecision_log_entry with status "approved — PM confirmed"DECLINE
declineddecision_log_entry with status "declined — [PM reason]"MODIFY: [instructions]
Level 1 gates do not pause the workflow. The PM can override after the fact:
OVERRIDE: [reason]The override is logged to the Knowledge Graph with the PM's reason. The agent output it overrides is marked override: true in the decision log.
| Agent | Level | Trigger condition |
|---|---|---|
| LaunchPad (open) | 1 | Always — readiness audit always requires PM review before proceeding |
| LaunchPad (close) | 2 | Always — post-launch monitoring plan requires approval |
| PriceLogic | 1 | evidence_quality = LOW; price change > 20%; net-new tier; existing customer pricing; revenue impact > ±15% |
| PriceLogic | 2 | Any pricing change affecting existing customers |
| RoadMap | 1 | Utilisation > 90%; blocked_by_commitment_flags non-empty; de-prioritisation of committed feature |
| UXLayer | 1 | accessibility_flags non-empty; trust calibration feature present; LOW evidence |
| NorthStar | 2 | North Star metric changing (north_star_change_flag = true) |
| DecideWell | 2 | Always — every DecideWell output requires PM approval before downstream agents proceed |
| GrowthIQ | 1 | NRR < 90%; at_risk_user_list > 5 accounts; financial incentives proposed; pql_alert = true |
| OpsCommand | 1 | Output is board_deck or crisis_communication_plan; external publication |
| OpsCommand | 2 | crisis_severity_score > 7 AND board or investor communication required |
| DataLayer | 3 | Always — every DataLayer governance checkpoint requires Level 3 clearance |
Level 2 (48h window)
timed_out; workflow remains pausedLevel 3 (72h window)
sign_off_required_by if Slack is connectedtimed_out; workflow blocked until named approver respondssign_off_required_byEvery gate response writes a decision_log_entry to the Knowledge Graph (if Supabase connected):
{
"id": "gate-[uuid]",
"workflow": "[W1–W6]",
"agent": "[agent name]",
"level": [1/2/3],
"decision": "[APPROVE / DECLINE / MODIFY]",
"status": "[approved / declined / modified — PM confirmed / PM modified]",
"reason": "[PM-provided reason or override text]",
"outcome_tracking_id": "[linked to decision for 30/60/90d follow-up]",
"timestamp": "[ISO 8601]"
}If Supabase is not connected: decision log is written to session context only and lost on session end.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.