# Five Gates Between a Guess and a Governed Answer > Approved meaning is not the end of the work; it is the start of it. The concrete governance machinery that turns a candidate definition into a Twin product you can answer with. Published: 2026-07-23T09:00:00Z Updated: 2026-07-24 Author: Archie Norman (Founder, MLX) Category: Twin Tags: twin, governance, approved-meaning, data-validation, publication, activation, evaluation, enterprise-ai Canonical URL: https://mlx.systems/blog/five-gates-to-a-governed-answer ## TL;DR - The five gates are governance controls, not five approval screens: human review is the one decisive act, while discovery diagnostics, validation and evaluation are evidence-producing controls that inform it. - Discovery readiness, proposal review, product validation, activation and query evaluation each answer a different question, and passing one can never stand in for passing another. - Publication and activation are deliberately separate: a validated product does not go live on its own, and activation fails closed when canonical identifiers, publication metadata, relation, contract or pinned skill evidence are invalid. - Governance is the refusal to let evidence from one stage impersonate evidence from another, which is why validation cannot certify meaning and activation cannot prove semantic truth. --- In most AI workflows, a number becomes true the moment the model says it. You ask what monthly recurring revenue was last quarter. The assistant retrieves a few tables, reasons across them, and returns a figure that is formatted, confident, and entirely plausible. Nothing in the pipeline distinguishes that figure from a governed one. It was produced, not ratified. Ask again tomorrow, or through a different model, and a different figure can arrive wearing the same composure. The previous article argued that the artefact enterprise AI is actually short of is approved organisational meaning, not more context. That is the destination. This article is about the road: the concrete machinery through which a candidate definition becomes a Twin product you can put in front of a board. Approval is not a signature on a wiki page. It is the outcome of a sequence of gates, and each gate exists to catch a different kind of wrongness. ## Five Questions, Not Five Sign-Offs It is tempting to picture five approval screens, a person clicking through a wizard. That is the wrong image. These are governance gates, and only one of them is a human decision. The others are evidence-producing or fail-closed controls: they generate diagnostics, check a claim against declared truth, enforce invariants, or record verdicts. Human review is decisive precisely because the machinery around it is honest about what it can and cannot prove. The point of separating the gates is that each answers a question the others cannot. Discovery readiness, proposal review, product validation, activation and query evaluation are not stages of one long approval. They are different examinations, and a pass in one is not evidence of a pass in another. Follow monthly recurring revenue through all five and the discipline becomes clear. ## Gate One: Discovery Readiness **The question: is there anything real here to define?** Before the system proposes what recurring revenue means, there has to be something source-backed to reason over. Discovery readiness checks that organisation-scoped, source-backed relations actually exist: real subscription and billing records, anchored to their provenance, scoped to this organisation and no other. A model can hallucinate a definition over nothing. A governed interpreter should not be allowed to. Discovery runs durably. It can proceed in automatic mode, where the system surfaces candidates, in guided mode, where a person steers it, or in explicit mode, where someone states exactly what they want, and it records diagnostics as it goes. Those diagnostics are the evidence this gate produces: what was found, what was thin, what could not be grounded. One temptation to resist here is treating relationship coverage as readiness. Knowing that subscriptions connect to accounts and accounts to invoices is useful, but a dense web of relationships is not the same as being ready to define a term. Coverage says things are connected. Readiness says there is grounded, scoped material worth proposing a meaning over. They are not the same claim, and conflating them is how you end up defining revenue over a graph that merely looks complete. ## Gate Two: Proposal Review **The question: is this what we actually mean, and who will sign it?** Discovery produces a deterministic convergence proposal: a concrete, repeatable statement of what recurring revenue means and how it is computed. Which plans count. How annual contracts are amortised into a monthly figure. Whether trials, discounts and paused subscriptions are in or out. The proposal is precise, and it is repeatable, but it is still only a proposal. This is the decisive gate, and the only one where the deciding act is human. Before anything is shared, and before anything is written to production, a person reviews the proposal and accepts it. The system proposes; an accountable person decides business meaning. That asymmetry is the whole design. Determinism gives you a proposal you can trust to be stable and reproducible. It does not give you a proposal you can trust to be correct, because correctness here is a business judgement, not a computation. Someone with the authority to mean it has to mean it. ## Gate Three: Product Validation and Publication **The question: does the thing we are about to publish hold against what we already know?** An approved proposal is not left as prose. Publication turns it into a set of connected artefacts: a stable `mlx_curated` relation that names the concrete result, a versioned product contract that gives the definition an identity you can reference and change deliberately, a generated skill and a routing snapshot so agents know the product exists and when to reach for it, validation evidence produced against real data, and, where it is warranted, an attached evaluation suite. Not every product carries a suite; some earn one, others do not. Validation is an evidence-producing control, and its honesty depends on one rule. Containment validation is permitted only against a separately declared, human-verified positive subset: a set of records a person has confirmed genuinely belong, at the same grain as the relation and with matching types. For recurring revenue that might be a hand-checked list of subscriptions everyone agrees are live and recurring. The check asks whether the published relation contains them. This is worth dwelling on, because it explains why validation cannot grade itself. If the truth set were generated by the same proposal it is meant to test, the check would only confirm that the proposal agrees with itself, which it always will. An independently declared, human-verified subset gives the check an external reference it did not author. Even then, containment tells you the relation includes what a person said must be there. It does not tell you the definition is the right one. Validation proves the pipeline behaved against a known-good sample. It does not certify meaning, and it is not designed to. ## Gate Four: Activation **The question: which governed definition is answering right now?** A published product is not a live one. Publication and activation are deliberately separate acts, and treating them as one is a category error. A product can be published, validated, and sitting inert. What makes it the definition your organisation answers with is activation, and the current active head is explicit and auditable: at any moment you can say which version is live, and see the record of it becoming so. Activation and deactivation are both supported, and revision, repair, activation and deactivation of products run through `sdk.twin` rather than through hand edits. Activation fails closed. It refuses to promote a product when the required canonical identifiers, the publication metadata, the relation evidence, or the contract and pinned skill evidence are missing or invalid. If the paperwork does not cohere, nothing goes live. That is the safe default, and it is the opposite of the ordinary AI reflex, which is to answer anyway. What activation does not do is prove that the definition is true. It proves that a coherent, validated product has been made the live one under an accountable act. Activating recurring revenue does not make your revenue definition correct; the proposal review did the meaning, and activation did the promotion. Reading activation as semantic proof would be exactly the impersonation this whole system exists to prevent. ## Gate Five: Evaluation **The question: when real questions arrive, does this version answer them well?** The final gate watches the product in use. Evaluation runs in manual, eval or canary mode, and it persists supported-query verdicts against the exact product and suite versions in play. That version pinning is the substance of it. A verdict is only meaningful if you know precisely which definition and which suite produced it, so evaluation records the answer to a supported question, the version that answered, and the judgement, rather than a floating impression of quality. Evaluation is separate from both discovery mode and activation, and it has to stay separate. Discovery mode is how a definition was found. Activation is which definition is live. Evaluation is how a live definition performs on real questions. These are three different facts. Two caveats keep this gate honest. It grades supported queries against a suite where one exists, so it is not a promise that every product carries an evaluation suite. And a good verdict on the questions asked is exactly that: evidence about those questions and that version, not a guarantee of universal correctness. Canary mode is a way to try a version against traffic deliberately, not an automatic net cast over everything. ## Why the Separation Is Inconvenient, and Worth It Five gates is more work than one. A single reflex, retrieve and answer, is faster at every step, and its speed is exactly its problem: it lets a plausible figure skip the questions that would have caught it. The separation is less convenient on purpose. Discovery readiness cannot be waved through because relationships look rich. Validation cannot be trusted because it validated itself. Activation cannot be read as truth because a product went live. Evaluation cannot be stretched into a universal warranty because it scored well on the questions it was asked. Each gate is narrow, and its narrowness is the feature. A gate that tried to answer all five questions at once would end up answering none of them rigorously, which is precisely the failure mode of a system where a number is true because the model said so. ## Governance as a Refusal Governance, in the end, is a refusal: the refusal to let evidence from one stage impersonate evidence from another. Grounded data is not an approved definition. An approved definition is not a validated product. A validated product is not a live one. A live product is not a proven-correct one. Each of those is a real and useful fact, and each is worth exactly what it certifies and no more. The gates exist to keep those facts from borrowing each other's authority. That is what it means for a number to be governed rather than guessed. Not that a person blessed every step, but that no step was allowed to claim more than it earned. And once meaning is governed this way, it becomes something many interfaces can use without redefining it: the recurring revenue figure decided here reads the same whether an agent, a report, or a first-party surface asks for it. That is the subject of the next article. Governed meaning is worth building once because it can be consumed everywhere, and the interfaces are where that payoff is spent. --- **Previous: *[Your AI Doesn't Need More Context. It Needs Approved Meaning.](/blog/approved-meaning-not-more-context).*** Why an organisation must settle meaning before an agent can use it reliably. **Next: *[One Twin, Many Interfaces](/blog/one-twin-many-interfaces).*** How each first-party interface preserves the same governed product, identity, scope, and evidence contract.