REVERSION

How to read a card

Each card shows these items:

What to do.
The four main criteria of the gate.
The person who makes the decision.
The stage to go back to if the gate fails.

Each item of the full checklist in the Playbook blocks the gate at its level. The card shows a summary only. It does not replace the checklist.

Three rules for all cards

Independence [P2.2]

Before the team uses a threshold, an exception, a restart or a light-path change, a person must approve it. The sponsor selects this person. This person knows the subject of the criterion. This person does not make the gate decision and is not the author. This person has no goal or public promise that depends on the result. This person does not work for the person who set the end date of the cycle. Team members examine items, but they do not approve these limits. Each threshold must agree with the limits in [P4.10]. A SEC person from outside the team must also approve these items:

An exception that makes a control less strict.
The third exception in a cycle, and each exception after it.
In a HIGH project, the containment thresholds, the pilot thresholds, and each restart after a security event.

If an approver does not reply, the gate stays closed.

Risk modules [P4.11]

In stage 01, select the risk modules for the project: external actions, personal data, minors, decisions about people, legal accessibility. An independent person approves the selection. If you are not sure, select the module. The trigger for M1 to M4 can be not clear. In this condition, select the module. Or get a written opinion from SEC, DATA or a domain specialist from outside the team. The items of a selected module also block the gate.

Evidence [P0.1]

Each checked item must show an artifact that a person can examine. An item without an artifact is not complete. Use N/A only where the Playbook lets you.

Level marks

(before 02-B): necessary before the first 02-B or 02-C.
(B+): necessary from level 02-B.
(C): necessary at level 02-C.
(B): necessary at level 03-B.
(Pilot+): necessary from 06-Pilot.

Roles

Abbreviation	Role
PM	Product Manager
PO	Product Owner
UX	UX Designer
DE	Designer (product and visual design)
CD	Content Designer
RS	Researcher
EN	Engineer
Tech Lead	Engineering lead
Design lead	The UX or DE person who is responsible for the product
SEC	Security and compliance
DATA	The person who is responsible for the data
A11Y	Accessibility specialist
Domain expert	A specialist in the decision area, for example a clinician. This person has a veto when the team selects module M4
Sponsor	An independent person outside the cycle. The sponsor approves exceptions and makes the final decision when a veto and a decision do not agree. The sponsor cannot remove a veto about personal data, irreversible actions, blocking barriers or module M4. The team names the sponsor in stage 01, with a reply time and a substitute

Terms from the Playbook glossary

These notes do not add rules.

Gate: a recorded human decision that lets the team go to the next stage.
Veto: the right to stop a gate.
Fallback: the stage that the team goes back to when a gate fails.
Degraded mode: the product behavior when the model fails or a person turns it off.
Flag: a switch that turns off a function without a new release.
Light path: a prompt change or a generation-parameter change, with fewer checks [P3.4].
Restart: the return to operation after a containment.
Formative return: a return to the previous stage to fix a problem that the current stage found. The team does not change the hypothesis, the audience, the criteria or the limits.
Holdout set: test cases that the team never uses to tune prompts.
Build agent: the AI tool that writes code for the team.
Blocking problem: a person cannot complete a critical task without help, or makes an important error and does not see it.

Understanding

01. Define & Distill

Model Probing

Define the problem with evidence. Then test if the model can solve it. Record the decisions that stay with people.

Gate

Evidence from independent sources supports the problem. The record shows the audience and the critical tasks.
The hypothesis has an acceptance criterion. The reason to use AI shows an estimated advantage over a solution without AI. Before 02-B, the probe measures this advantage.
The record shows the purpose and the selected risk modules. (before 02-B) The record also shows the autonomy matrix and the risk level.
(before 02-B) The model probe uses synthetic or pseudonymized data. Before the probe, an independent person approves the minimum rate of correct answers and the maximum number of serious errors. The probe meets the two values. The team keeps a holdout set.

Authority

Decides: PM
Reviews: PO. The PM must obey this review. If the PO is also the PM, a person who knows the subject of the acceptance criterion does the review. This person did not write the hypothesis or do the probe. The sponsor selects this person.

Fallback

Go back to 01 and write the problem again. After 2 returns without new evidence in a cycle (formative returns do not count), the PO selects one of these options. If the PO is also the PM, the sponsor selects.

Write the problem again. This option is possible only with new evidence that the reviewer accepts.
Pause the project.
Stop the project.

AI limits

AI gives structure and suggestions. AI does not set priorities, criteria or data use.

Owners

DE (AI Product Designer) and PM, with the Tech Lead for the probe

Reference tools

Notion, Claude, ChatGPT, Linear, Miro

Examples, not requirements.

Full checklist: Playbook P3.1

02. Vibe-Prototype with AI

Generative Sketching

Change the hypothesis into an interface that people can test. Use the lowest level that answers the question. The level goes up when the prototype can do more.

Levels

A, interface only: no real calls, no secrets, and a private preview.
B, real model with synthetic data: no write operations and no send operations.
C, real effects: write, send, real data, external input, or a preview that people outside the build team can open. A controlled research session does not count.

Gate

The builder records the level at the start. At the gate, an engineer who did not build the prototype examines the level against the final code.
The main flow has no dead ends. A person can complete it with the keyboard only. Each critical task has one scripted AI error.
(B+) The platform controls the spend limit and the stop. The agent does not control them.
(C) The prompt-injection tests pass, also when the model obeys the injected instruction. Only the owner of the changed object can confirm an action. This person uses a login factor that a person cannot recover through the channel of the injected content. If a person publishes the output, the approval of that person does not count as a block.

Authority

Decides: PM
Reviews: a person who did not build the prototype. At level C, also an engineer who did not build it. In a HIGH project, also SEC and DATA.

Fallback

If the hypothesis or the limits are not clear, go back to 01. If the problem is in the implementation, stay in 02.

AI limits

The build agent works only in the isolated environment. It does not increase permissions. It does not connect data.

Owners

UX and DE, with EN at level C

Reference tools

Cursor, v0, Bolt, Claude Artifacts, Claude Code

Examples, not requirements.

Full checklist: Playbook P3.2

Shaping

03. Micro-Test & Expand

Behavior Design

Test with people. Expand only the parts that work in the critical tasks. The diagnostic level lets the team make more changes. The representative level lets the team show the product to people outside the organization.

Levels

A, diagnostic: internal participants, or participants that are easy to find.
B, representative: minimum 5 participants for each segment. Select them with the criteria of the segment. Employees count only if the audience is internal.

Gate

The team writes a dated plan before the first session. Each round uses a frozen version.
No blocking problem occurs in the critical tasks. The report gives counts (x of n).
Each participant sees one simulated AI error for each critical task. Accepted errors and rejected correct answers are not more than the maximum. An independent person approved this maximum before the sessions.
(B) The frozen version has the minimum sample. Or, before the sessions, an independent person approves a smaller sample. A smaller sample has minimum 3 participants for each segment. The plan records the gap.

Authority

Decides: PO
Reviews: a person who did not run the sessions or build the prototype. At level B, also the sponsor if the PO is also the PM.

Fallback

Stay in 03, or go back to 02 or 01.

AI limits

AI makes summaries with read-only access. Each result shows its source. AI does not approve an expansion.

Owners

RS and UX, with the PM consulted and the v-team informed

Reference tools

Slack, Loom, Maze, Hotjar, Notion

Examples, not requirements.

Full checklist: Playbook P3.3

04. Modular Refactor

Verified Refactoring

Make a decision: promote the prototype code, or write it again. Integrate in small changes. Keep code, prompts and configuration under version control, and test them.

Gate

The record shows the promotion decision. A person who did not write, dictate or instruct the content, and did not make the commit, does the review.
CI passes. The evals stay in the threshold margin against the approved baseline. The accessibility tests show no new critical or serious violation.
Each AI function is behind a flag. When you set the flag to off, the product goes to degraded mode.
The trigger items are complete: migration, idempotency, queues, restore, shared cache. Use the light path only for a prompt change or a generation-parameter change. Do not use it above the change limit [P4.10]. Do not use it after an incident or an alert signal, until the restart.

Authority

Decides: Tech Lead. The Tech Lead cannot be the author. If the Tech Lead is the author, a Tech Lead from a different team decides. With the small-team exception [P2.2], the sponsor decides.

Fallback

Stay in 04, or go back to 03, 02 or 01.

AI limits

AI generates and refactors code. It does not integrate and does not merge. It does not change CI, permissions or the autonomy matrix.

Owners

EN and DE

Reference tools

Cursor, Claude Code, GitHub Actions

Examples, not requirements.

Full checklist: Playbook P3.4

Delivering

05. Design Polish on Demand

Behavioral Coherence

Improve the parts that are already useful. Accessibility and user control start in 02. In this stage, the team makes them better.

Gate

All states [P4.7] are consistent in the critical flows.
WCAG 2.2 AA, plus the legal or contract standard if there is one. The automatic tool shows zero critical or serious violations. A person reviews each success criterion. No exception covers a blocking barrier.
The streaming output has an announced status, a stable focus and a control to stop it.
The product shows the AI notice at the moment of the decision. People from the audience understand it.

Authority

Decides: the design lead who did not make these improvements. If there is no design lead, the PM decides with an external designer.
Veto: A11Y. If there is no A11Y, the qualified substitute [P2.1] has the veto.

Fallback

Stay in 05, or go back to 04, 03, 02 or 01. The cause tells you where to go.

AI limits

AI gives proposals and does checks. It does not approve brand, interaction, content or accessibility.

Owners

UX, DE (visual), CD and EN (frontend)

Reference tools

Figma, Storybook, Tailwind CSS, Framer, Claude Code

Examples, not requirements.

Full checklist: Playbook P3.5

06. Ship the POC

In-Context Validation

Release only at the approved exposure level. Each level adds conditions to the level before it. The approval of a demo does not approve a pilot.

Levels

Demo: use by employees only, with no real data and no external action. An output that a person publishes or sends to third parties is an external action. The label of the output does not change this. A Demo is possible only after 03-A and 04 pass.
Pilot: people outside the organization, real data or external action, for a limited part of the audience [P4.10]. A Pilot is possible only after 03-B passes.
Production: general availability, or more people than the Pilot limit.

Gate

A flag turns off the tested function. The agent cannot get access to the flag. When the flag is off, the product goes to degraded mode.
The platform controls the cost limits. The telemetry has no personal data. The exposure stops automatically at its end date.
(Pilot+) 03-B passed with the real model. An independent person approved the containment thresholds. The automatic stop passed its test. SEC from outside the team did a review. If there is personal data, DATA from outside the build team also did a review.
(Pilot+) The pilot plan has a measured baseline and thresholds to expand or stop.

Authority

Decides: PO
Attests: an engineer who did not prepare the release. For the accessibility items, A11Y or the qualified substitute (Pilot+).
Veto: SEC from outside the team (Pilot+). DATA (personal data). A11Y or the qualified substitute (blocking barrier). The domain expert (M4).
Reviews: the sponsor (Pilot+, if the PO is also the PM).

Fallback

Turn off the function with the flag. Or go down to the last approved exposure level, if the team did a test of this step. In a Demo, turn off the function and stop the Demo. Then go back to 04, 03, 02 or 01. Send only presentation problems or accessibility problems to 05.

AI limits

The automation does the approved release. AI does not increase the audience, the data or the actions.

Owners

EN and Tech Lead. The PO decides. PM and DE for the pilot plan. SEC from the Pilot

Reference tools

Vercel, Railway, PostHog, Sentry, Notion

Examples, not requirements.

Full checklist: Playbook P3.6

Principles for all six cards [P4]

A good demo does not prove consistent behavior.
An instruction in the prompt is not a security control.
When you restore the software, you do not restore the data or the external effects.
When a person confirms an irreversible action, the action stays irreversible.
Contain first. Then write the documentation. Any alert signal lets you contain.
The person who makes a decision does not set the limits for that decision. Silence is not approval.