Documentation
Plan

45 of 187 pages

AI Product Studio

Work Packages & the Readiness Gate

A Work Package does not move because someone clicked Approve. It moves because its gate review passed — every Definition of Ready item assessed by whoever owns it, the evidence attached and attributed, the reviewer agents asked, and a named human recording the decision. The same review closes the package at the other end against the Definition of Done.

Why a review rather than a tick-list

A checklist that records only that somebody ticked a box tells you nothing later: not who, not when, not why, and not what they were looking at. And a checklist the browser enforces is not a gate at all — anything calling the API directly walks straight past it. The gate review replaces the tick-list with something you can hand to an auditor: the work package, plus the evidence that its Definition of Ready was met.

Where the checklist comes from

A new work package is gated against your studio's Definition of Ready — the one on the Work Package Checklists page, or the variant you have set for that kind of intent. It is read from your settings when the package is created rather than chosen by whoever created it, because a checklist the creator picks is a standard the creator can set to nothing. Studio owners and reviewers can still tailor an individual package's checklist afterwards.

For the same reason a package cannot be created already approved. Approval is something the gate produces, not something you can declare when you make the record.

Starting a review

Open a package and choose Start readiness review. The review takes a copy of the package's Definition of Ready as it stands — each item's label, whether it is required, and who it is assigned to — so later edits to your studio-wide checklist cannot quietly rewrite a review already in progress.

The same click sends every agent item to its agent and then asks the reviewer agents for their verdict. You do not have to wait for them: your own items can be settled while the agents work. To send one agent item on its own instead, use the send button on that item before you start the review. In a Supervised studio, starting the review sends nothing: you send each agent item yourself, one at a time.

Who clears what

Items assigned to an agent — delegated automatically. The agent assesses the item against the package and returns met, not met, or blocked when it cannot honestly decide. A blocked item comes to you.
Items assigned to a person — queued for that person to mark Met (which asks what satisfies it) or Does not apply. The second is a waiver: a decision that the item is not relevant to this package, so it demands a written reason and is limited to studio owners and reviewers.
Signing off an agent's item yourself — you can, but it counts as a waiver: owner or reviewer, with a reason. Ticking off "Security review complete" with the word "done" is exactly what the gate replaced.
Items with no assignee — queued for the owner or a reviewer.

Only met and waived satisfy a required item. Everything else leaves the gate shut.

Evidence

Every assessment attaches evidence: a one-line summary of what was found, the full finding behind it, who recorded it (a person, or the agent by role), when, and — for an agent's finding — the person who asked for it. Evidence is append-only — nothing already recorded can be edited or removed, including by the person who wrote it.

The agents run on our servers, not in your browser. Your studio asks for an assessment; the question put to the agent is written by us, the package is read from your studio's own records, and the answer is recorded exactly as the agent gave it. Nothing in the page can compose the question or supply the answer — otherwise an agent could be told what to conclude, which would make its finding worth nothing as evidence.

The verdict

Once the checks are settled, the reviewer agents give their verdicts — go, wait, or revisit — and the panel shows their consolidated opinion, which is always the most cautious of them. A studio owner or reviewer then records the final verdict.

Running a reviewer again replaces its opinion but does not delete the old one: the earlier verdict stays on the review, marked as superseded. An agent you can re-run until it agrees with you is not a reviewer, and the thing it disagreed about is precisely what decides whether your go is recorded as an override.

Two approvals: the agents' and yours

Every gate has two sides, and both must approve before the package can move. The reviewer agents approve on one side; a studio owner or reviewer decides on the other. Neither stands in for the other — your approval does not override the agents, and theirs does not replace yours. Approve for dispatch (and, at the other end, Mark complete) is always there, greyed out until both sides have approved.

Below the checklist, before the two panels, a banner gives the agents' recommendation in large letters with the reason beneath it: AGENT RECOMMENDATION: DO NOT DISPATCH — Human approved, awaiting agent approval, or READY TO DISPATCH once both have approved. The panel below it shows the two sides next to each other, each turning green only on its own approval. The Definition of Done gate says the same things about shipping.

Reviewer agents — lists what the agents have approved and what they are blocking on, and lets you ask them to assess again.
Human approval — three buttons: Go, Wait and Revisit. Each opens a short dialog showing where the package stands and asking for your rationale. Go is unavailable while a required item is still outstanding. Every decision you record is kept in the panel's Decision history.
Overriding the agents is a controls exception. If the agents are blocking and you are satisfied their blockers do not apply, an owner or reviewer can choose Override agent blockers in the Reviewer agents panel. That approves the agents' side on their behalf. It does not approve your side — a person still has to decide separately. The dialog lists the blockers you are setting aside, asks for a justification, and asks you to tick that you are taking the exception knowingly. It is logged against your name under its own heading in the audit log, so exceptions can be reported on separately from approvals, and it is voided if the package changes. Every override and waiver on the gate also shows up together in an Overrides and waivers summary at the foot of the checklist.

A waiver and an override are both exceptions: each records who granted it, why and — where one is set — until when, and an exception that has expired leaves its item unmet. See Gate Exceptions & Expiry.

Items from your organisation

If your studio belongs to an Enterprise organisation with an active guardrail policy, every new work package starts with the organisation’s items at the top of its checklists, marked with a lock and the policy version they come from. You can add your own items, and — where the policy allows — add a reviewer or a control to an organisation item. You cannot remove one, reword it, make it optional or take a reviewer off it. A work package keeps the policy version it was created under, even after the organisation activates a newer one.

Controls and the Passport

A checklist item can name the compliance controls it is evidence for, and every gate decision is recorded in the work package’s evidence ledger as it is taken. The Passport tab shows the result: each control’s status, every exception, and the evidence behind each item. See Artefact Passport & Evidence Ledger.

Each item can have an agent reviewer and a human reviewer

A Definition of Ready or Done item is reviewed by an agent or by a person — never both on the same row. Agent items sit in their own block with the Reviewer agents panel beneath them; human items sit in a separate block with Human approval beneath that. An item that names both reviewers appears once in each block. Human assessment is a compact dropdown (Met, Not met, Does not apply); standing in for an agent is Override Agent, recorded as a waiver. The Work Package Plan holds grouped markdown pages (Design, Security, Architecture, or whatever the item asks for). Agents read the current Plan; when an item is not met they can propose pages. A Semi-Autonomous or Fully Autonomous studio applies those pages immediately and assesses the item again against them; Supervised waits for you to click each agent, then to ask for the missing documentation, which is proposed for you to apply.

You choose an item's reviewers on the Work Package Checklists page: tick Agent reviewer, Human reviewer, or both. The agent list names the agents on your roster, so an item can be given to one particular agent — including one imported from your repository — rather than to whichever agent fills a role. See Agents from Your Repository.

Separation of duties. By default one person may both approve on the agents' behalf and give the human approval. A studio owner can require different people under Trust Settings → Approval controls. With it on, whoever overrides the agents on a gate — or signs an item off for its agent — cannot also give that gate's or item's human approval, and the other way round.

Changing the package invalidates the evidence

An assessment was true of the package as it stood at the time. So every decision is stamped with a fingerprint of the package's material content — its title, scope, work items, acceptance criteria, selected agents, context, policies and both checklists. Edit any of those and the decisions taken against the old version are marked invalidated, the verdict is cleared, and the package cannot be approved until the gate is run again.

The panel says what changed and what it cost you, and offers to re-run. The evidence itself is kept — it is history, not a mistake; it records what was true then.

Moving a package through its lifecycle is not a material change, so approving or dispatching never invalidates the gate it is passing through.

What the gate refuses

Approve, Dispatch and Complete are all checked on the server, in every operating mode, whatever the UI shows. A refusal names what is missing rather than saying "forbidden":

No review started — the package has no gate review yet. Start one.
Required items outstanding — each one is listed, with its state and whether it is waiting on you or on an agent.
The package changed — the review is stale and must be re-run.
No current verdict — the checks pass but nobody has recorded a decision for this version of the package.

Closing the package: the Definition of Done

Completing a package runs the identical machinery against its Definition of Done. A package reaches Completed only when that gate passes. Definition of Done items can read the pull request that delivers the package: their evidence is pinned to the commit they judged, a new commit marks it stale, a shortfall is sent back to the coding agent as a coding action, and the pull request's merge is held until the gate passes. See Delivery: Coding Runs, Pull Requests & the Merge Hold.

Operating modes

The operating mode decides who acts, never whether the gate exists. In 🤝 Semi-Autonomous studios every agent assessment starts together and any documentation they propose is applied to the Plan immediately — but an item assigned to a person still waits for that person. In 🧑‍✈️ Supervised each step is separate: click the agent to run, click the finding to write missing documentation, and apply pages yourself. Auto Pilot's end-to-end journey stops before the gate: it leaves each work package as a draft; sending it for review and starting its readiness review are yours to do.

Packages created before the gate existed

They have no review, so approving one is refused until you start it. There is deliberately no grandfathering: a package silently waved through is precisely the thing this exists to prevent.

All AI Product Studio documentation

Build v0.3.2 · deployed 2026-10-19T23:52:31Z