A week with governed AI, on the floor

The people in it

Nine of the twenty-four, and one of them is the admin.

Roles here are access, not job titles — they are what Sallyport grants. One person holds one of them, which is the whole reason two different approvals can mean two different things.

MK Melanie Koster Admin Operations Director. Signs off as the manager.

AM Anna Meijer Finance Books what comes in. Rarely at a desk to do it.

TB Thomas Bakker Sales His accounts, and only his.

HB Hannah Bos DPO Classifies the fields. The only one who can.

DV David Visser Sales Asks for more than he has. Gets an answer either way.

JV Julia Vermeer Admin The one who does open the rules screen.

RW Robert de Wit Auditor Reads the log. Reads nothing else.

IM Iris Mulder HR Holds what nobody else may. Approves nothing of hers.

LB Lisa de Boer Starts Monday Not a user yet. That is scene seven.

Melanie approves as a manager. Hannah approves as the DPO. Two approval paths, two people — that is the product working, not a naming detail.

Monday, 08:47

The handbook says twenty-seven. His row says twelve.

The most ordinary question anyone asks an HR department, asked of an assistant instead. It has two halves, and only one of them is anybody’s business but his.

Scene 01 · sales × hr

The rule is a document. The number is a row.

“How many leave days do I have as a manager, according to the handbook?” The handbook half is a paragraph in handbook-v4.pdf, on the company’s own drive, which all twenty-four of them may read and which says the same thing to all of them: twenty-five days, and two more for a managing role. Gemini reads it there, the way it reads everything else on that drive. Sallyport is not asked, and should not be.

The other half is his — accrued, taken, booked, carried over — and it is one row of twenty-four. That half comes through the gate, filtered to the person asking, exactly as his 212 customers do two scenes later. He gets one answer and never sees the join.

handbook · the drive +

TBThomasSales · his own row → 27

One line in the log, not two. The gate records the row it was asked for. It has nothing to say about the handbook because nobody asked it about the handbook — and a document that every employee may read is a document that needs no gate in front of it.

08:47

GeminiCOMPANY DRIVE + SALLYPORT

Thomas · Sales How many leave days do I have as a manager, according to the handbook?

Gemini Twenty-seven this year, and you have twelve left.

Base, all staff	25 · handbook §4.2
Managing role	+2 · handbook §4.3
Taken	13
Booked, October	2

Allowed · his own row

SEEN BY THE GATE
08:47:12 thomas@
leave_balance · read
1 of 24 rows
handbook never asked

Thomas · before the stand-up

How that number usually gets there

Somebody exported it once, in January … to verlofsaldo-2026.xlsx, in a folder shared with everyone except external users, because that was the fastest way to answer the question the first time somebody asked it.

× The assistant answers — correctly
× And for the other 23 people, to anyone who asks
× Row-level rules cannot help: it is one file
× No record of who asked, or what came back

The same question, through the gate

Nothing was exported The handbook stayed a handbook, the balance stayed a row, and the assistant asked for exactly one of them.

✓ 1 row returned, of 24
✓ 1 name against the request
✓ 0 spreadsheets to find and delete
✓ The other 23 answers were never possible

Indexing the drive was never the mistake. Putting the row on the drive was.

A handbook is a document and should be indexed. A leave balance is a row, and the only reason an assistant can read yours is that somebody turned it into a document. Every file-based assistant honours the permissions on the file — that is not the problem. The problem is that a file has one permission for all twenty-four people, and the answer does not.

Monday, 11:24

The invoice that chased itself.

A supplier mails a PDF to an inbox. Nobody opens it, nobody types it into anything, and it is booked before the train gets to Amersfoort.

Scene 02 · finance × operations

Anna approves it from a train.

The mail lands at facturen@studiovandaag.nl and a webhook wakes the playbooks. The PDF is read where it sits — supplier, date, lines, VAT, total — and matched against the open projects in Gripp. It is over €1.000, so it stops and asks a person.

That person is Anna, because the rule says finance signs invoices, and Sallyport knows which human that is. She gets one card. Two taps later it is a purchase invoice in Moneybird with the document filed against it.

AMAnnaFinance · approves →

MKMelanieManager · counter-signs → booked & filed

Anna never opened Moneybird. Melanie never opened anything. The only person who has ever seen the rule that routed it is Julia, and she wrote it in March.

11:24

Approval neededSALLYPORT

Purchase invoice · over your €1.000 threshold

€2.480,00

De Groot Media · 21% btw

Matched to De Groot — rebrand Cost centre Creative Read from factuur-2026-0412.pdf Due 28 Sep 2026

Approve Ask a question

Over €1.000 also needs a manager.
Melanie is next in the chain.

Anna · on the 11:09 to Amersfoort

playbooks · inbound invoice · run 4,318

Inbound invoice → bookkeeping on every supplier mail

MailInvoice lands at facturen@studiovandaag.nl 1 attachment

SallyRead the PDF — supplier, date, lines, VAT, total €2.480,00 · 21% btw

GrippMatch to an open project and cost centre De Groot — rebrand

Approval · over €1.000Anna · Finance approved · AM · 11:24

Approval · managerMelanie · Operations Director approved · MK · 11:25

MoneybirdBook the purchase invoice and file the document booked · doc attached

Run finished 11:25 · 41 s of machine time, 90 s of Anna’s · the document never left the EU

The same run is in the audit log, with the two approvals named. An invoice that nobody can show you the approval for is the actual finding — not the invoice.

Tuesday, 10:42

He asks about his clients.

Thomas is in a car park between two meetings. He is not going to open a CRM on his phone, and he does not have to.

Scene 03 · sales, on the road

He sees 212 rows. He never learns about the other 328.

The gate resolves who is asking on every single request — not once at login, and not from something carried around inside a token. Thomas’s row filter is his accounts, active ones, not on credit hold. It is applied on the way out, and pushed into Gripp’s own query where Gripp can express it.

So he does not get a filtered view of the whole customer base. He gets a smaller world, and there is no seam in it where the rest used to be — no greyed-out rows, no “insufficient permissions”, nothing to screenshot and complain about. The IBAN comes back masked because the DPO said so, and he has never needed it anyway.

The 328 withheld rows are the product. Most of this page is about people noticing something happened — an approval, a refusal, a form. This is the first of the three where the point is that nobody notices anything, and the other two are both about their own record.

10:42

SallyGOVERNED · GRIPP + MONEYBIRD

Thomas · Sales Which of my clients have overdue invoices?

Sally Three, €7.000 in total.

De Groot Media	€4.210 · 12d
Vos & Partners	€1.870 · 5d
Atelier Lindenhof	€920 · 3d

Allowed · his accounts

SEEN BY THE GATE
10:42:07 thomas@
moneybird.invoices.list
212 of 540 · 328 withheld
iban masked

Thomas · car park, Nieuwegein

The row filter and the field policy that decide this are shown, as screens, on the governed page. This is the same two rules from the other side.

Tuesday, 16:05

He moves house. Three systems find out.

The most ordinary thing an employee ever does to their own record, and the one place where being able to read something and being able to change it are obviously not the same permission.

Scene 04 · sales → hr

Three fields are his. The rest of the row is not.

He types one sentence on the sofa. The row it lands on is his own — the same row filter as the CRM, on a table where it resolves to one of twenty-four. What he may write on it is three fields: address, phone, next of kin. He is not shown a form with greyed-out boxes; the rest of the row simply is not part of the write.

His IBAN comes back masked, as it does everywhere else on this page, and the date he gave is a value in a field the record already had — from 1 October. Nothing is scheduled and nothing is held. The systems read the date when the date matters.

TBThomasSales · his own row → 3 systems →

IMIrisHR · confirms the allowance

The commute allowance is the only part that stopped. A new address changes what the company owes him every month, and money is not a thing you let a person set on their own record — so it asks Iris, and she is the only one it could have asked.

16:05

SallyGOVERNED · YOUR OWN RECORD

Thomas · Sales I’m moving on 1 October — Lijnbaansgracht 214, 1016 XA Amsterdam.

Sally Done, from 1 October. Three fields changed on your record, and your commute allowance goes to Iris because the distance changed.

Allowed · 3 of 19 fields

SEEN BY THE GATE
16:05:31 thomas@
employee · update
1 of 24 rows · 3 fields
iban masked

Thomas · Tuesday evening

his own row · what the write reached

Field	Comes back	He can change it	Because
address	in full	yes	his to keep current
phone	in full	yes	his to keep current
next of kin	in full	yes	his to keep current
iban	masked	no	changing where wages land is not self-service
contract dates	in full	no	read is a different grant from write
commute allowance	in full	no	it is money — Iris signs it

SallyportWrite the three fields, effective 1 Oct 1 row · 16:05

Sign-off · humanIris confirms the new commute allowance approved · IM · 16:09

MoneybirdUpdate the payroll record from 1 Oct

SupplierBuilding pass and the insurer told 2 notified

AuditWho changed what, on whose row evt_4a71

Four minutes · one of them Iris’s · and he never opened a portal to do it

It is the same rule as the scene above, on a table with one row in it. He has never seen the other twenty-three employees, and three of the fields on the one row he can see are not his to change — not hidden, not greyed out. Simply not part of what he was granted.

Wednesday, 14:31 → 15:08

Refused. And then, thirty-seven minutes later, not.

Most access control ends at “no”, which is why people route around it. This is the same “no” with a door next to it — and the door is the reason the “no” holds everywhere else.

Scene 05 · sales → DPO → back

David wants birthdays. He gets a reason, then a form.

Beat one. He asks for every client contact’s date of birth, for a birthday mailing. Hannah classified that field as personal data in March, and the classification is gate-wide: it does not matter which tool he asks through, or which assistant. He gets a refusal that says which field and whose rule — not an error code, and not silence.

Beat two. In the same thread there is a button. He states what for and how long, and it goes to Hannah, because a personal-data request is hers and nobody else’s.

Beat three. Hannah gets the whole picture on one screen: the field, its classification, what the standing rule says, who else currently holds it, and what he wrote. She grants seven days, read-only.

Beat four. On the 17th it reverts. Nobody schedules that, nobody remembers it, and the log records the expiry as its own event.

DVDavidSales · refused 14:31 →

HBHannahDPO · granted 15:08 → expires 17 Sep

14:31

SallyGOVERNED · GRIPP

David · Sales Give me the birthdays of all our client contacts — I want to send a card.

Sally I can’t share that. contacts.birthdate is classified personal data by your DPO, and Sales isn’t granted it on any connector. Nothing about the question was wrong — the field just isn’t yours.

Sally You can ask Hannah for temporary access. It takes about a minute.

Refused · personal data

Request temporary access

David · 14:31

15:07

Access requestSALLYPORT · DPO QUEUE · 1 WAITING

Requested by

David Visser · Sales

Field gripp · contacts.birthdate Classified Personal data Standing rule not granted to Sales Who holds it now nobody Asked for 7 days, read-only

His reason “Birthday cards for the fifty accounts I actually own. I don’t need the date itself, only the month — but I’ll take whatever is easiest to grant.”

Grant · 7 days · read-only Narrow to his own accounts

Reverts on 17 Sep with no further action.
Both the grant and the expiry are logged.

Hannah · 15:07, iPad

exceptions · studio vandaag · 4 active

Who	Change	Scope	Until	State
David · Sales	grant read-only	gripp · contacts.birthdate	17 Sep · 7 days	active
Anna · Finance	grant View	exact · invoices	30 Sep	active
Contractors	revoke all access	gripp · contacts	31 Oct	active
Support	unmask iban	moneybird · contacts	expired	reverted

That fourth row is the point of the table. Nobody had to remember to take it away — and standing exceptions are exactly how least-privilege quietly dies.

A refusal without a next step is a policy nobody follows. The reason this one holds is that going around it is slower than going through it: thirty-seven minutes, one form, one person who was always going to be the right person to ask. Ban the assistant instead and David sends the same request to a colleague over Slack, gets a spreadsheet, and none of it is anywhere you can look.

Thursday, 08:20

Everybody needs to know. Nobody may know why.

HR holds the most sensitive data in the building and, in most companies, has the least to show for how it is held. This is the one scene where the correct answer is that a question has no answer for anyone.

Scene 06 · hr × operations

Iris registers it in nine seconds and records nothing she may not.

Anna calls in at ten past eight. What the company needs is genuinely operational: she is out, since today, expected back Monday — because somebody has to cover the De Groot delivery. Melanie sees exactly that and reschedules around it.

What nobody sees is why. Not Melanie, not the assistant, not the log, and not Iris — under Dutch law the reason belongs to the occupational health service and never becomes an employer’s record at all. So there is no field to mask here. There is a field that no profile is granted, and Hannah classified it in March, the same March as the birthdays.

Then the part she cannot do herself. Thomas’s commute allowance is waiting from Tuesday. She proposes it and the gate sends it to Melanie, because a person who can both propose and approve a payment is not a control. Two people, two roles — the same shape as the invoice, on HR’s side of the building.

IMIrisHR · registers →

MKMelanieManager · approves → reason: held by nobody

“Nobody holds it” is a sentence you can only say about a rule. A folder with the right people in it is a claim about today. Iris can show that the field is granted to no profile at all, and that the answer was the same last March, which is a different kind of statement entirely.

08:20

Absence · Anna MeijerSALLYPORT · HR · REGISTERED 08:20

What the company records

Out · back Monday

Anna Meijer · Finance

From Thu 10 Sep Expected back Mon 14 Sep Her manager sees both dates Reason granted to no profile Classified by Hannah · March

Waiting on her, from Tuesday Thomas Bakker · commute allowance, new address from 1 Oct. She may propose it. She may not approve it.

Send to Melanie Ask Thomas for the distance

Cover for the De Groot delivery is Melanie’s call.
Nothing here reaches the assistant.

Iris · 08:20, the HR queue

Every other refusal on this page is a rule somebody wrote. This one is a rule somebody passed. That is the harder one to keep, because keeping it is invisible and breaking it is convenient — one note in one field, by one person meaning well, on a Thursday morning. The reason to put it in the gate rather than in a policy is that the gate is the only version of it you can hand to somebody who does not take your word for it.

Thursday, 09:11

One sentence, four departments.

Onboarding is the process every company has and nobody has written down. Here it is written down exactly once, and it runs itself the next twelve times.

Scene 07 · operations → admin → finance

Melanie types it. Julia approves the one part that needs a human.

Seven tasks across four systems, and only one of them stops. The Sales role is a grant of access, so a person decides it — that is Julia, in about four seconds, from her phone. Everything either side of it is machinery.

Note what the pause is not: it is not a ticket, not a reminder, and not a step someone has to know exists. The playbook holds, asks the person whose job it is, and carries on the moment it has an answer.

MKMelanieOps · one sentence → 3 systems →

JVJuliaAdmin · signs off the role → mail & calendar

Lisa is a user before she is an employee. On Monday at 08:00 her calendar has a day-one agenda in it, and the only person who typed anything was Melanie, on Thursday, in one line.

09:14

Sign-off neededSALLYPORT · NEW HIRE

Grant a connector role

Sales

to Lisa de Boer

Reaches gripp · 14 entities Row filter her own accounts Personal data none granted Requested by the New hire playbook

Approve Grant something narrower

Step 4 of 7 · the run resumes on your answer

Julia · 09:14

playbooks · new hire · started from one sentence in chat

Melanie · Operations Director Onboard Lisa de Boer, starting next Monday.

Sally Running New hire — seven tasks, first day Mon 14 Sep. I’ll stop at the role grant and ask Julia.

New hire · Lisa de Boer first day Mon 14 Sep 7 of 7 done

SallyportCreate the account and SSOlisa@studiovandaag.nl · 09:12

GrippAdd to the team and her first project2 records · 09:12

MoneybirdDraft the payroll recorddraft · 09:13

Sign-off · humanJulia approves the “Sales” roleapproved · JV · 09:14

SupplierOrder the laptop and the access badgeordered · 09:14

MailIntro to the teamsent to 24 · 09:15

CalendarDay-one agenda and the first check-inMon 08:00

Four minutes end to end, of which one human took four seconds. The other three minutes and fifty-six were waiting on three vendors’ APIs.

Eight months later

The half everybody forgets.

Every company has an onboarding checklist. Ask for the offboarding one and you get a pause, then a name, then “I think IT does it”.

Scene 08 · the one nobody runs

What is actually left behind is not the account.

Everyone remembers to disable the login. It is visible, it is one click, and somebody notices if it does not happen. That is why it is almost never the thing that leaks.

What stays is quieter: the two temporary exceptions granted in March for one afternoon and never revisited, the seven projects she owned, the twelve client relationships with her name in the owner field — which is also the field somebody else’s row filter is matched against, so those records now belong to nobody and appear for no one.

Sallyport knows all of it, for the boring reason that it granted all of it. The trigger is her last day landing in the HR record; the run starts three days ahead of it.

An access review finds this eleven months late. The run finds it three days early, and the difference between those two sentences is most of what an auditor is actually asking about.

06:00

Offboarding · Lisa de BoerTRIGGERED BY A CHANGE IN THE HR RECORD · T−3 DAYS

SallyportRevoke SSO and end live sessions2 sessions ended

ExceptionsRevoke the temporary grants she still holds2 found · both from March

GrippReassign the projects she owns7 → Thomas

GrippTransfer the client relationships12 → David

Moneybird · ExactRemove the accounts, keep the records2 systems

Approval · financeAnna releases the final payslipapproved · AM

AuditClosure record to Robertevt_9f2c · signed

Nothing of hers is reachable after Friday 18:00 · 21 objects moved, 0 orphaned

The run, three days before her last day

Without the run · what is still live in March

Somebody disabled the login on her last day … and that was the whole offboarding. It was also the only part anybody would have noticed was missing.

× 2 exceptions still granting a field nobody remembers
× 7 projects owned by a person who left
× 12 clients matching no live owner, so on nobody’s list
× 1 API token issued to her, still valid

With it · the same Friday, 18:00

The run closes and files itself Everything she was granted is gone, everything she owned belongs to a named person, and the whole of it is one record in the log.

✓ 0 standing grants left
✓ 0 orphaned records
✓ 0 live credentials
✓ 1 closure record, signed, in Robert’s log

The difference is not diligence. It is that one of them is a checklist and the other one is a trigger.

The week, from the floor

Eight scenes, and one rules screen between them.

Everything above was decided by rules somebody wrote once. Here is what each person actually did instead of reading them.

AM Anna · FinanceTapped Approve on a train. Never opened Moneybird, never saw a PDF, never typed an amount.

TB Thomas · SalesAsked three questions from three sofas and car parks. Never learned that 328 rows were withheld, which is the correct amount to learn, and never opened a portal to move house.

DV David · SalesWas told no, and told why, and told who to ask. Had the field thirty-seven minutes later, for seven days.

HB Hannah · DPOMade one decision, with everything she needed to make it on one screen. Classified the field once, in March.

MK Melanie · OperationsWrote one sentence, counter-signed one invoice and approved one allowance. All three from a phone, and she has never seen why Anna was out.

JV Julia · AdminThe one person who does open the rules screen — and did not need to this week, because she opened it in March.

RW Robert · AuditorRead the log. Read no customer record, no invoice and no contact, because the Auditor role reaches none of them.

LB Lisa · joined, then leftHad working access on her first morning and none of it by her last evening. Was never asked to chase either.

IM Iris · HRRegistered an absence without recording why, and asked for money she was not allowed to approve. Both of those are the job, and both of them are now provable.

This is the argument for governing instead of banning, made from the inside. A ban is a rule that costs these nine people their week and buys you nothing you can show an auditor — it does not stop the work, it moves it to a personal laptop where there is no filter, no mask and no log. Every “no” above cost someone under a minute, and every one of them is a line in a record nobody can quietly edit, us included.

Nobody here configures anything.