Chapter 7: Operational Tempo
Executive Governance Series
Operational Tempo
Substrate-level governance has a tempo: the cadence at which detection, classification, remediation, escalation, and SLA enforcement run. Without an explicit tempo, even a deterministic substrate degrades — findings pile up, remediation contracts are not honored, and the substrate’s evidence reflects neglect rather than discipline. This chapter explains the tempo the Federal Modernization Program declares and what it requires of the operating program.
The tempo declared in canon
16_DriftDetectionStandard.qmd declares severity-to-SLA mapping verbatim:
| Severity | Auto-remediate? | SLA |
|---|---|---|
P1 (critical) |
No — halt + alert | Immediate |
P2 (high) |
Yes, if deterministic | 1 hour |
P3 (medium) |
Yes | 24 hours |
P4 (low) |
Yes | 72 hours |
This is the substrate’s tempo. Programs that adopt the Federal Modernization Program inherit the tempo as a canonical commitment, not as a target to negotiate.
What the tempo requires of the program
Three operating commitments:
- Continuous detection.
fmp substrate walkruns in CI; runtime adapters emit findings as they execute. Detection is not audit-cycle. - Bounded remediation. Every finding has an SLA; auto-remediation handles deterministic fixes; the human-judgment subset escalates.
- Escalation paths land at named roles. Per the drift standard, escalation paths are
Canon Steward | Architecture Lead | CISO— not generic distribution lists.
A program that declares tempo but does not honor SLAs is itself generating drift in the operational layer. The substrate detects this through its own findings backlog: a substrate with chronic open findings is signaling that the program’s tempo is out of step with the canonical SLAs.
Auto-remediation versus escalation
The SLA model deliberately auto-remediates deterministic fixes and escalates the rest. Three structural reasons:
- Auto-remediation that requires judgment is unsafe. A fix that depends on context cannot run unattended.
- Escalation that auto-remediates undermines the canon-change process. Authority to mutate canon belongs in the canon-change ADR review, not in an adapter’s auto-fix path.
- The split clarifies what humans do. Humans tune the classifier, review escalations, and author ADRs. Humans do not do ticket triage on routine drift.
The operations team’s view
For a substrate operations team, the tempo presents:
- A live findings queue scoped by severity and adapter.
- Per-finding remediation contracts that record what was done and by whom (human or auto).
- An SLA dashboard showing P1/P2/P3/P4 burn-down rates.
- Escalation channels routed by canon-defined paths, not by ad-hoc routing rules.
The operations work shifts from “monitor everything” to “tune the classifier and respond to escalations.” Most P3/P4 findings are auto-handled; most P2 findings auto-remediate when deterministic; only P1 and the human-judgment subset of P2 reach a human in the loop.
The leadership view
For program leadership, the tempo presents three measurable properties:
- Detection coverage — what fraction of the runtime surface is emitting drift findings? (Today: schema/provenance fully via CI; semantic/authz/identity via adapters that have implemented runtime conformance.)
- SLA adherence — what fraction of findings remediate within their SLA?
- Escalation rate — what fraction of findings escalate to a human? (Higher escalation rate = either drift severity is rising, or the classifier needs tuning.)
These three are program health metrics, not just operations metrics.
What the tempo does not require
- It does not require 24/7 staffing. P3/P4 findings auto-remediate within their SLA; P1 findings halt and alert, preserving substrate integrity until a human responds.
- It does not require eliminating drift. Drift is the signal; the tempo bounds response, not occurrence.
- It does not require a vendor SaaS. The tempo runs entirely on the substrate hosted by the agency.
Honest limits
- Auto-remediation is bounded to deterministic fixes. As the runtime detection surface matures, the auto-remediation envelope grows; today, semantic/authz/identity drift more often escalates.
- SLAs are enforceable only when findings are emitted. Adapters that have not yet implemented runtime conformance contribute no findings, and their drift is invisible to the tempo.
- The escalation paths assume the named roles exist in the agency. Programs without a Canon Steward role have to designate one; the substrate cannot manufacture authority.
Key takeaways
- Operational tempo is canonical, not negotiable.
- Auto-remediation handles deterministic fixes; escalation handles the rest.
- The split clarifies what humans do.
- Detection coverage, SLA adherence, and escalation rate are program health metrics.
- Honest limits remain around runtime maturity and role assignment.
Next: Chapter 8 — Governance at Scale — how the same tempo and taxonomy hold across hundreds of adapters, many programs, and multiple authorization boundaries.