Skip to content

Dual-Surface Sign-Off

Sign-off protocol — instantiates Summary-Substance Alignment Audit

Refuses to approve the summary and the substance separately: the two are signed off together, by accountable owners, or neither ships.

A Dual-Surface Sign-Off is the governance gate that makes summary–substance fidelity somebody's job before release rather than a discovery after it. Its defining move is to couple the approvals: the summary and the substance are not signed off in separate workflows by separate people, but released as a pair in one approval event, by owners whose sign-offs are bound together and who are accountable for the two matching. It does not detect divergence — it assigns ownership of it. At the gate it makes the review map visible (who drafted and who checked each surface, and where their incentives pull), names the owner accountable for each surface and the escalation owner who breaks a tie, and stamps which surface is operative and which is a non-binding summary.

Example

Before a fund is offered, two artifacts must publish: the full prospectus — the substance, and the operative legal document — and a short investor summary. In the EU regime the summary is a Key Information Document, which is legally required to be fair, clear, and not misleading relative to the prospectus. A dual-surface sign-off makes one approval event of both: the accountable product owner and an independent compliance reviewer sign the KID and the prospectus together, against a map showing who drafted the KID (the marketing team, rewarded for a compelling story) and who must independently check it. The gate stamps the KID with its status — a summary for orientation, not the operative contract, which is the prospectus. Neither can be released on a lone signature over the summary; if the two disagree, the named escalation owner decides before anything ships.

How it works

  • Name the accountable owner for each surface and the escalation owner who resolves a summary-versus-substance dispute.
  • Surface the review map — who authored and who reviewed each surface, with incentives visible, since the summary's author is often the one rewarded for overselling.
  • Require one coupled approval, not two independent ones, so no summary is signed without someone confirming it against the body.
  • Stamp the genre/operative status — which surface binds, and that the summary does not.

Tuning parameters

  • Coupling strictness — advisory joint review, or a hard block on any unpaired sign-off.
  • Reviewer independence — whether the summary's author may approve it, or a second, unincentivized party must; this dial decides whether the gate has real teeth.
  • Escalation path — who breaks a tie, and how fast.
  • Label prominence — how loudly the summary is marked non-operative, from a footer note to an on-face banner.
  • Scope — which document classes require dual sign-off versus a lighter check.

When it helps, and when it misleads

Its strength is putting a name and an accountable moment on summary–substance fidelity, so it is owned rather than assumed — the four-eyes principle applied across the two surfaces at once.[1] Its failure mode is ceremony: a sign-off proves that someone approved, not that the summary is actually faithful, so a rubber-stamp gate adds ritual without scrutiny. The classic misuse is coupling the signatures while letting the same conflicted author supply both, so the "second eye" is nominal. The discipline is genuine reviewer independence and keeping the incentive map visible at the gate, so the person signing the summary is not the person rewarded for its spin.

How it implements the components

This protocol fills the ownership-and-approval side of the audit — the machinery that makes fidelity accountable before release:

  • claim_owner_and_escalation_owner — names the owner accountable for each surface's fidelity and the escalation owner who resolves a summary-vs-substance dispute.
  • author_incentive_and_review_map — records who authored and who reviewed each surface and where their incentives pull, surfaced at the gate so amplification is anticipated.
  • genre_label_or_nonoperative_status_note — the sign-off fixes and stamps which surface is operative and marks the summary's non-binding status.

It gates release; it does not detect or measure divergence (Headline–Body Consistency Check, Certainty & Causality Inflation Check, Material-Divergence Red Team) or push corrections afterward (Correction Synchronization Workflow). The status label it stamps on a whole document is the document-level cousin of the excerpt label a Quote-Snippet Context Window puts on a single fragment.

References

[1] The four-eyes principle (dual control) requires two independent parties to approve an action before it takes effect; here the two pairs of eyes are trained on the summary and the substance at the same moment, so neither is approved without the other in view. ↩