The five gates
UA-5 — Universal Acceptance — defines five conditions that must be true before any consequential work product advances. They are the 5, Universally Accepted gates that make all of this work. They are gates, not guidelines. A work product that does not satisfy all five has not been governed.
The gates are universal — they do not vary by domain, team, tool, or stakes level. What varies is the depth of evidence each gate requires, determined by Measure.
Five gates. Five words.
Explain. Trace. Store. Stop. Check.
One for each gate, in order. If you remember nothing else, remember these.
Explainability Required
No consequential work product advances without a clear account of what it is, why it exists, what risks it carries, and what trade-offs were accepted. The person responsible for the work can explain it to someone who wasn't in the room when it was produced.
Work that nobody can explain after the fact. Decisions reconstructed from memory. Output accepted because it looked right, not because anyone understood it.
Provenance on Every Artifact
Every work product has clear attribution: who produced it, what tools were involved, what sources were drawn from, and when. If AI participated in producing the work, that participation is disclosed — including what the AI contributed, what the human directed, and where the boundary lies.
This gate is never deferred — not in emergencies, not in degraded mode, not ever. Attribution takes seconds. There is no circumstance in which provenance is waived.
Work with unknown origins. A vulnerability, error, or flawed recommendation traced to output nobody remembers creating. AI contributions that are invisible to reviewers, auditors, or successors.
Recallable Evidence
The reasoning, reviews, and approvals behind the work product are stored in a durable location and retrievable on demand. Not in someone's memory. Not in an ephemeral conversation. Not in a channel that gets archived. In a system of record that the next person can find.
The three-day reconstruction. An auditor, successor, or future version of you asks "why was this decision made?" and the answer requires archaeological excavation.
Critical Risk = Hard Stop
When a critical risk is identified — by the practitioner, by a reviewer, or by the AI — the work product does not advance until the risk is remediated or formally accepted with documented rationale, an identified owner, and compensating controls.
The acknowledged-and-ignored risk. A critical concern raised during review, noted, and then silently moved past. The incident that everyone knew was coming because the risk was visible and nobody stopped.
Validation Availability
The mechanisms used to validate the work product — whatever they are in the domain — are operational and their status is visible. If validation infrastructure is unavailable, work is queued, not silently advanced.
Work that shipped while the checks weren't running. A test suite that was down. A review process that was skipped. A quality gate that was silently bypassed because the system that enforces it was offline.
The gate invariant
Five gates. Not eight. Not twelve. Five. The minimalism is the point. The gates do not change based on who you are, what domain you work in, or how high the stakes are.
| Dimension | Universal (does not change) | Proportional (scaled by Measure) |
|---|---|---|
| Which gates apply | All five, always | — |
| Evidence depth | — | Shallow for low stakes, deep for high stakes |
| Review thoroughness | — | Quick check vs. multi-pass deep review |
| Formality | — | Inline notes vs. structured records |
| Who approves | — | Peer vs. domain authority vs. release authority |