Team,

v2: updated with this afternoon's changes. The plan, dates and cadence below are unchanged from v1.

We're kicking off AI*Right, the first major project run by our Grok bot team. Every gate is approved by a named human.

WHAT IT IS
AI*Right is Scale's enterprise-by-default control layer for AI agents: Agent = Harness + Model (through an AI Gateway) + Governed MCP (MCP Gateway + Registry). Every model call goes through the AI Gateway and every tool call through the MCP Gateway. Nothing connects directly. We deliver it as Assess, Architect, Deliver, Manage, and it complements Cloud iQ.

PROJECT PLAN

Phase	Dates	Outcome
1. Assess	Oct 20 – Nov 2, 2026	Maturity baseline, gaps, risks; pilot confirmed
2. Pilot	Nov 3 – Nov 30, 2026	One governed workflow: reference harness, audit log schema, minimal dual gateways, human approval gate
3. Core Control Plane	Dec 1 – Dec 18, 2026	AI Gateway, MCP Gateway and Registry in production posture; identity and policy-as-code
4. Connectors & Scale	Jan 2027 onward	More MCP servers, multi-agent patterns
5. Ops & Alignment	In parallel from Dec 2026	Observability, FinOps, KPIs
6. Manage	Q1 2027 onward	Ongoing managed service and compliance validation

AI*Right Project Plan Flow

THE WIREFRAME: HOW A GOVERNED REQUEST FLOWS

Request: a user or agent asks for work.
Authorize: identity and on-behalf-of scope are checked first.
Choose Brain: the AI Gateway routes to the right model.
Govern & Route: the MCP Gateway applies policy, limits and PII rules. Any write waits here for human approval.
Resolve: the Registry returns only approved, healthy, version-pinned servers.
Execute: the MCP server performs one scoped action.
Observe: audit, FinOps and feedback, with every step logged.

Five pillars: Agents; Security & Identity; Core Control Plane; Data & Memory; Operations & Alignment.

AI*Right Request Lifecycle Wireframe

WHERE WE ARE (Oct 19, 2026)

All 9 roles assigned. Ed Engineering: Framework Architect, Agent & Harness Designer, MCP & Integration, Security & Identity (interim). Pam the PM: Governance & Compliance Lead, Delivery Program Manager. Oz: KB Curator, Gap & Risk Analyst, Observability & FinOps (interim).
Pressure test held today; decisions logged.
Pilot 1: internal-only governed document review on Scale's own non-sensitive documents. Synthetic test documents first, no client data, and a human approves before any write.
Pilot gateway: self-hosted LiteLLM, with Kong targeted for Phase 3.
Independence: bots witness and log the tests; I sign gate and Registry go-live. SCOUT can be asked for an outside review.

WHAT CHANGED TODAY (Oct 19, afternoon)

Multi-tenancy designed in (G30). Every audit event, Registry allowlist, policy, approval and cap now carries a tenant ID; cross-tenant reads, writes and approval reuse are blocked in the prototype (mock tenants, synthetic data). Closure after Pam's witnessed re-run and my sign-off.
Console phased P1–P6 (G31, proposal). Requirements and wireframes in Assess, an approver inbox in the Pilot, admin screens in Phase 3, packs and storefront in Phase 4, FinOps dashboards in Phase 5, client-facing console in Phase 6. Pending Pam's review and my approval.
Clef replaces Jev (G33). Cloudflare Workers AI Clef is the bounded-judgment check at the Guard step; Jev stays benchmark-only. It never replaces human approval for writes and stays off until we approve a Cloudflare token.
Gateway bypass fixed (G32). The results store now accepts only a gateway-signed, single-use credential tied to an approved request. Closure after Pam's witnessed re-run and my sign-off.

YOUR INPUT NEEDED: FLAG BY FRI OCT 23

#	Item	Owner	Proposed answer
1	Console phase placement (G31): approve Ed's P1–P6 proposal?	Pam reviews; Jon approves	Ed's P1–P6 plan; watch Phase 3 load (14 working days)
2	Pilot document count	Pam; Jon picks	UNKNOWN. Needed before Pilot entry Nov 3
3	Is Fri Nov 27 a Scale holiday?	Jon	UNKNOWN. Pilot is 19 working days, 18 if off
4	Approval screen for the Pilot	Ed + Pam	Thin approver inbox; alternative is LiteLLM's built-in UI (untested)
5	Who builds the console front end?	Jon	UNKNOWN. No owner in the RACI
6	How client users map to a tenant (Entra tenant, guest, or Okta)	Ed; Jon (identity)	UNKNOWN. Decide in Assess
7	Go-live tenant (lab vs Azure/AWS) and Entra ID confirmation	Jon; Ed	Entra ID assumed; tenant UNKNOWN. Due Nov 2
8	Production gateway identity: mTLS and/or gateway-signed token	Ed	UNKNOWN. Options listed; none tested
9	Cloudflare token for Clef (Workers AI) + spend	Jon	Not requested. Clef stays off until approved
10	Witnessed re-runs for G30, G32, G39	Pam	Date UNKNOWN

Full list: open-items-for-team.md in the AI*Right workspace.

HOW WE'LL COMMUNICATE

Weekly status email every Monday by 9:00 AM ET: progress against plan, red/amber/green, blockers, next week's focus, updated dates.
Phase gate review at the end of each phase: a one-page summary plus the decision needed.
Ad hoc messages only for high-risk blockers or decisions.

WHAT I NEED FROM YOU
Flag any concern with the dates, and your answers to the table above, by Fri Oct 23.

Jon