Four eyes
A second signature on every number, and the model marking its own homework
A ledger row can be changed by hand, and a changed row changes every answer after it. In a company with a board, an auditor or a lender, that is not a thing one analyst does alone at nine in the evening. A proposal is a change written down with the reason, what the model says it does to the next twelve months, and a place for a reviewer to sign or refuse.
Build a twinRoles and snapshots
The proposer cannot sign the second line, whatever their seat. That is the whole point of four eyes.
The most expensive number in a model is the one somebody changed quietly. A proposal makes the change loud, dated, reasoned and reversible.
Every approval takes a snapshot of the ledger first, so the moment before the change is always one click away, and the row that changed carries the proposer, the reviewer and both their notes for good.
The life of a proposal
From an edit to a signed change
Propose it, with the reason
Pick the number, say what it should be and why. A proposal with no reason is refused, because a reviewer with nothing to read cannot review. The old value, its band and its origin are kept on the proposal, so the reviewer sees exactly what would change.
- Any number in the ledger
- A band, carried over from the current row or typed
- The reason, kept for good
The model runs before anybody signs
The twin runs twice at low replication with the same seed: once as the ledger stands and once with the proposed number in it. The difference over twelve months is the proposal's impact, kept with the proposal, so the reviewer sees the same figure the proposer saw whatever changes in between. When a number does not move the simulation, the proposal says so rather than showing a row of zeros.
A reviewer approves or rejects
Approving takes a snapshot, moves the ledger, locks the row, and writes the proposer, the reviewer and both notes on it. Rejecting leaves the ledger alone and keeps the proposal with the reason. The proposer can withdraw. Nobody can approve their own proposal.
- A snapshot before every approval
- The proposal.decided event on hooks
- An alert if a proposal waits longer than the days you set
The rule
Switch it on and an analyst's edit becomes a proposal
The owner of a twin can require a reviewer for changes to the ledger. With the rule on, an analyst who edits a number in the ledger is asked for the reason, and the edit lands in the queue instead of the ledger.
Owners and reviewers still edit directly, because they are the people the rule exists to bring in.
- Off by default; on with one switch
- Analysts propose, reviewers and owners decide
- Viewers read the queue and nothing else
The track record
Every new answer carries how the old ones did.
The decision register knows how often a closed decision landed inside the band the model gave, and which way outcomes lean. The monitor knows how far the actuals have run from the pinned forecast, metric by metric. Every new analysis reads both. Three or more closed decisions move the confidence, by up to fifteen points. A metric the monitor has seen drifting gets its band widened by the drift seen, and the answer says so, because a band the actuals keep escaping is not a band.
Two signatures. One snapshot. No quiet changes.
Proposals come with the governance layer, on the Operator plan and above.