Operating Model & Governance

The KLOSIT operating rule is: Rules detect. AI explains. Humans decide. System tracks. Every workflow, alert, and dashboard is designed to obey this sequence.

• Detection before opinion.
• One owner per KPI.
• One decision, one approver.
• Every alert has an action.
• Every action has an SLA.
• Every SLA has a review.

Payment governance enforces the Phase 2 discipline through daily and weekly review cycles, escalation paths, and refund thresholds.

• Daily: invoice status board reviewed by CS lead.
• Weekly: aged receivables reviewed by Finance + CS lead.
• Refund below 10k EGP: CS decides with founder awareness.
• Refund at or above 10k EGP: Founder approval required.
• Discount request: proposed by CS, approved by Founder only.

Every active client carries a Health Score composed of five weighted components summing to 100. Thresholds trigger CS intervention and, at the risk band, founder escalation.

Support tickets are classified by category and severity. SLA times below apply to first response, workaround, and full resolution.

Every product idea is classified as Revenue-critical, Governance-critical, Adoption-critical, or Nice-to-have. Feature scoring uses a weighted 100 model.

Every recurring decision names a Recommender, an Approver, and an Executor. Only one Approver per row.

Nabih AI operates strictly within the Explain step of the operating ladder. It does not decide, spend, refund, sign, or discount.

• No autonomous action on financial or contractual events.
• Every AI-generated brief includes source references.
• Human approver named on every AI-triggered escalation.
• AI outputs may be overridden by any owner within their scope.

• Least privilege by default; role-based access enforced.
• Every data change is auditable; nothing hard-deletes without a documented policy.
• Access reviews are quarterly; offboarding is same-day.
• Secrets never in code, never in chat, never on personal devices.
• Backups verified by restore, not by presence.

The management rhythm is small, opinionated, and durable.

• Founder workspace: strategy, financing, decisions, escalations.
• CTO workspace: platform, security, V0/V1 progress, AI governance.
• CS workspace: onboarding pipeline, Health Score, renewals, SLA compliance.
• Finance workspace: invoices, aging, refunds, marketing spend.

Phase 5 explicitly inherits and enforces Phase 2 commercial rules. The two most common misinterpretations are called out here to prevent recurrence.

1. 01Operating rule visible in every alert card.
2. 02One owner per KPI declared.
3. 03One approver per decision declared.
4. 04Every alert linked to a defined action.
5. 05Every action linked to an SLA.
6. 06Every SLA linked to a review.
7. 07Client Health Score computed for every active tenant.
8. 08Health thresholds trigger CS intervention automatically.
9. 09Risk band escalates to founder within 24 hours.
10. 10Support severity applied to every ticket.
11. 11SLA compliance visible in Support workspace.
12. 12S1 post-mortems shared with clients ≤ 5 business days.
13. 13Feature scoring applied to every V1 candidate.
14. 14Decision-rights matrix visible to every operator.
15. 15Refund threshold enforced automatically.
16. 16Discount requests routed to founder only.
17. 17AI never signs, spends, or refunds.
18. 18Nabih briefs cite source references.
19. 19Access reviews executed quarterly.
20. 20Offboarding executed same-day.
21. 21Backups verified by restore quarterly.
22. 22Weekly commercial review meets on cadence.
23. 23Monthly financial review meets on cadence.
24. 24Quarterly board & strategy meets on cadence.

Phase 5 makes KLOSIT operable. It converts the identity, pricing, GTM, and financial anchors into daily behavior — with named owners, measurable KPIs, and enforceable cadence.

The next operational gate is bringing the decision-rights matrix and Client Health Score into live use inside HQ workspaces.