Insights
Our writing is the byproduct of building software at scale for clients we cannot always name. We publish what we have learned, the patterns that hold up, and the assumptions we have had to revise.
Six weeks after a model went live, a reviewer asks what the approver actually saw on screen at sign-off. The registry has the artefact. The ticket has the name. Nobody can reconstruct the decision. This piece argues the missing primitive is an immutable promotion event, and shows what belongs inside it.
More from the firm
Your registry knows which model shipped. It does not know what the approver agreed to. When an auditor asks which challenger comparison was on screen the moment v17 was promoted, three Slack messages and a timestamp will not answer the question. Here is the promotion event pattern that does, routed by materiality instead of ceremony.
May 28, 2026
Your registry can prove a model existed. It cannot prove what an approver reviewed before clicking approve. That gap surfaces during the first serious audit, six months after the promotion, when nobody in the room can reconstruct the screen the approver saw. Here is the record-design fix.
May 23, 2026
Six weeks after a credit model goes live, an auditor asks what the approver actually saw before clicking approve. The registry has the artefact, the metrics, the dataset hash. None of that reconstructs the screen. This is a recording discipline problem, not a tooling one, and the fix is a separate immutable record of decision state.
May 22, 2026
Your model registry knows the version, the metrics, and the dataset hash. It does not know what the approver was looking at when they clicked approve. Six months later, that is the gap an auditor will sit in. Here is the event you should have been writing all along, and what belongs inside it.
May 20, 2026
An auditor asks what your approver actually saw before signing off a credit model six months ago. Your registry, your ticketing system, and your wiki each hold a fragment. None of them, stitched together, answers the question. Here is the single immutable record that does, and how to decide which promotions deserve it.
May 15, 2026
Your model registry knows the artifact. It does not know the decision. When internal audit asks what the approver was looking at the moment they signed off on a credit-risk model, lineage graphs and metric snapshots will not answer the question. A single immutable promotion event will. Here is the schema and the routing rule.
May 13, 2026
A credit-risk model gets promoted, the registry records the version and metrics, and six months later an auditor asks what the approver actually saw on screen before clicking approve. Nobody can answer. This is the gap between artefact state and decision state, and what to seal into a single immutable promotion event.
May 9, 2026
Six months after a credit-decisioning model goes live, the audit walkthrough begins. The registry has every field you'd expect: version, metrics, dataset hash, approver name. None of it answers the only question that matters: what did the approver actually see when they clicked approve? This is the gap between inventory and evidence, and how to close it.
May 8, 2026