Skip to content
Applications

Risk Limit Breach

MARKET RISK / LIMIT GOVERNANCE

What must be resolved before an internal risk-limit breach can be permitted as a temporary exception?

An internal risk limit may already be breached or may be expected to be breached by a planned transaction. At that point, a risk state is known. What the organisation may do with that state has not yet been decided.

Because a limit breach is not the same as an approved exception. A robust decision must establish which limit applies, which exposure creates the breach, which risk evidence exists, which uncertainties remain, which alternatives are available, which independent challenge has taken place, which conditions bound an exception and which authority may actually approve it.

In this illustrative case, a large European universal bank intends to execute a substantial client-facilitation transaction in EUR credit trading. The desk's existing internal stress-loss limit is €40.0 million. Taking the full position would increase modelled stress loss to €47.6 million. The business therefore requests a temporary limit of €50.0 million for 72 hours.

Much of the relevant information already exists. But the Independent Market Risk Function cannot yet establish with sufficient confidence whether the full position can be reduced or hedged in a controlled manner within the requested period under current market conditions.

The relevant question is therefore not only that the internal limit would be exceeded.

The question is whether exposure, evidence, uncertainty, conditions, independent challenge and approval authority can form one coherent governed decision state.

LIMIT BREACH ≠ EXCEPTION APPROVED

I / THE RISK-LIMIT DECISION

A limit breach is a risk state. It is not yet a decision.

01

The internal limit is clear

For this illustrative case, we will call the bank Trusted Bank SE. The organisation is entirely fictional. The EUR Credit Trading function operates an internal EUR Credit Stress-Loss Limit as part of the institution's internal risk-governance model.

Primary source: ECB SREP — Internal Governance and Risk Management methodology

Measure

Internal stress-loss limit

Illustrative value

€40.0m

Measure

Current utilisation

Illustrative value

€31.8m / 79.5%

Measure

Projected stress loss after full transaction

Illustrative value

€47.6m / 119.0%

The full transaction would therefore exceed the existing internal limit. That establishes a risk state. It does not determine whether the transaction should proceed, whether a temporary exception is possible, which conditions would be required or who may approve it.

02

The business situation

An institutional client wants to sell a large portfolio of EUR-denominated corporate bonds at short notice. Trusted Bank considers acquiring a substantial portion onto its own trading book, temporarily warehousing it and then progressively distributing or hedging the exposure.

A commercial rationale can explain why an exception is being considered. It does not create authority to exceed the applicable risk limit.

03

The exception request

Parameter

Existing internal limit

Requested state

€40.0m

Parameter

Requested temporary limit

Requested state

€50.0m

Parameter

Duration

Requested state

72 hours

Parameter

Scope

Requested state

Defined client transaction and associated bond portfolio

Parameter

Purpose

Requested state

Temporary warehousing and orderly distribution

Parameter

Required endpoint

Requested state

Return within the ordinary limit

May Trusted Bank SE execute the full client-facilitation transaction and permit a bounded 72-hour exception to the existing internal EUR Credit Stress-Loss Limit?

04

Breach, remediation and exception are different states

BREACH DETECTED

≠

BREACH REMEDIATED

≠

EXCEPTION APPROVED

A temporary exception may permit a bounded deviation. It does not retrospectively erase the underlying breach.

05

External hard constraints remain outside the exception

This Decision Space concerns only an internal risk limit that the institution's governance framework permits the competent authority to address. A regulatory or otherwise non-discretionary hard constraint cannot be changed merely because an internal authority approves an exception.

Primary source: Capital Requirements Directive (CRD)

INTERNAL EXCEPTION AUTHORITY ≠ AUTHORITY OVER EXTERNAL HARD CONSTRAINTS

06

Responsibility, independent challenge and approval authority are separate

In the illustrative Trusted Bank model, the Head of EUR Credit Trading owns the business rationale and submits the exception request. The Independent Market Risk Function reviews and challenges the risk state, evidence, assumptions, conditions and exit path. The Group Market Risk Committee holds approval authority for this class of exception.

Primary source: EBA Guidelines on Internal Governance

REQUESTER

≠

INDEPENDENT CHALLENGE

≠

APPROVAL AUTHORITY

II / DECISION SPACE v1

The breach is known. The complete decision state is not.

07

Many material states are already resolved

  • 01Specific client transaction and intended warehouse scope
  • 02Applicable internal limit and current utilisation
  • 03Projected utilisation after the full transaction
  • 04Commercial rationale and available hedge structures
  • 05Relevant internal policy and accountable roles
  • 06Required approval authority under the illustrative governance model

The Decision Space is not blocked because the bank has no information. It is blocked because one material condition has not yet been sufficiently characterised.

08

Risk evidence is more than the current limit value

The decision does not depend only on the fact that modelled stress loss is €47.6 million. Relevant evidence also includes stress behaviour, concentrations, market liquidity, expected exit capacity, hedge availability and effectiveness, market impact and the time profile of the exposure.

Primary source: ECB SREP — Market Risk methodology

09

The central evidence gap concerns stressed exit capacity

Can the full exposure actually be reduced or hedged as intended within the requested 72-hour window under stressed market conditions?

  • 01Actual exit liquidity
  • 02Potential spread widening
  • 03Market impact during disposal
  • 04Hedge capacity under additional stress
  • 05Remaining exposure after 24, 48 and 72 hours

10

Forward-looking uncertainty is not a missing fact

Uncertainty

Market liquidity over the next 72h

State

FORWARD-LOOKING / UNKNOWN

Uncertainty

Market impact

State

UNCERTAIN

Uncertainty

Hedge capacity under additional stress

State

UNCERTAIN

Uncertainty

Remaining exposure after 24 / 48 / 72h

State

UNKNOWN

UNCERTAINTY ≠ MISSING GOVERNANCE

11

Assumptions are neither facts nor evidence

  • 01Market conditions do not deteriorate fundamentally beyond modelled stress
  • 02Hedge instruments remain sufficiently available
  • 03The risk system represents the position and portfolio correctly
  • 04The transaction scope remains unchanged
  • 05No new higher-order hard constraint becomes relevant during the window

FACT

≠

EVIDENCE

≠

ASSUMPTION

12

A genuine professional conflict exists

Position

Business

Current state

Full position can reasonably be distributed or hedged within 72 hours

Position

Independent Market Risk

Current state

Current evidence is insufficient to support that assumption under stress

EXIT-CAPACITY ASSESSMENT — CONFLICTING

13

Alternatives belong to the decision basis

Alternative

A0 — No Full Facilitation

Meaning

Do not take the full position

Alternative

A1 — Resolve v1

Meaning

Obtain additional evidence or mitigation and reassess the same request

Alternative

A2 — Reduced Scope

Meaning

Take a smaller exposure

Alternative

A3 — Staged Facilitation

Meaning

Split the transaction into controlled stages

Alternative

A4 — Hedge-First Structure

Meaning

Apply mitigation before further exposure

14

Authority is itself a state

The Group Market Risk Committee is identified as the competent approval authority in the illustrative model. But authority identified is not authority exercised, and a senior authority cannot substitute for missing decision evidence.

15

Decision Space v1 as a complete state

Dimension

Decision Identity

Current state

RESOLVED

Dimension

Limit Identity

Current state

RESOLVED

Dimension

Exposure Identity

Current state

RESOLVED

Dimension

Risk Measurement

Current state

RESOLVED

Dimension

Requirements

Current state

PARTIAL / OPEN

Dimension

Evidence

Current state

MATERIAL GAP

Dimension

Stressed Exit Capacity

Current state

NOT SUFFICIENTLY CHARACTERISED

Dimension

Uncertainty

Current state

MATERIAL / OPEN

Dimension

Assumptions

Current state

VISIBLE

Dimension

Alternatives

Current state

VISIBLE

Dimension

Responsibility

Current state

BOUND

Dimension

Independent Challenge

Current state

BLOCKING

Dimension

Approval Authority

Current state

IDENTIFIED / NOT EXERCISED

Dimension

Conditions

Current state

INCOMPLETE

Dimension

Finality

Current state

NOT AVAILABLE

A risk-limit Decision State connects the applicable internal limit with exposure, risk measurement, evidence, uncertainty, assumptions, alternatives, responsibility, independent challenge, approval authority and conditions.
INTERNAL LIMIT
EXPOSURE
RISK MEASUREMENT
RISK EVIDENCEOPEN
UNCERTAINTY
ASSUMPTIONS
ALTERNATIVES
RESPONSIBILITY
INDEPENDENT CHALLENGEBLOCKING
APPROVAL AUTHORITY
CONDITIONSOPEN

State at T0

Decision Space v1

Full Client Facilitation

€50m / 72H

The limit breach is one input into the Decision State. It is not the Decision State itself.

III / WHY v1 CANNOT CLOSE

A blocker is the causal result of several unresolved states.

16

The central blocker

STRESSED EXIT / RISK-REDUCTION CAPACITY — NOT SUFFICIENTLY CHARACTERISED

STRESSED EXIT EVIDENCE — INCOMPLETE

↓

72H RISK-REDUCTION PATH — NOT SUFFICIENTLY CHARACTERISED

↓

EXCEPTION CONDITIONS — NOT YET BOUNDED

↓

INDEPENDENT RISK CHALLENGE — BLOCKING

↓

APPROVAL CONDITION — OPEN

↓

DECISION SPACE v1 — NOT FINALISABLE

The blocker is not one missing document. It emerges because several relevant dimensions do not yet form one finalisable common state.

17

"Approval missing" would be the wrong description

COMMITTEE DECISION MISSING

≠

THE STATE TO BE DECIDED IS NOT YET SUFFICIENTLY BOUNDED

18

Raising the limit would not automatically resolve the blocker

A higher number does not establish whether the underlying exposure can be controlled under the intended conditions. The open state concerns scope, time, exit capacity, hedge capacity, monitoring, reduction milestones, stop conditions and independent challenge.

A HIGHER LIMIT ≠ A RESOLVED DECISION STATE

19

What SEAL does not say at this point

  • 01SEAL does not say that the transaction is commercially wrong.
  • 02SEAL does not say that €47.6m of stress loss is inherently too high.
  • 03SEAL does not say that the bank is acting unlawfully.
  • 04SEAL does not say that the position cannot be reduced.
  • 05SEAL does not require all uncertainty to disappear.

The conditions defined for Decision Space v1 do not yet form a finalisable common state.

20

A blocker is not a dead end

A conventional approval workflow might stop here with Pending or Rejected. Neither status explains what would actually need to change for a robust decision to become possible. This is where SIMULATION begins.

  • 01SIMULATION does not approve an exception.
  • 02SIMULATION does not set a risk limit.
  • 03SIMULATION does not replace a Risk Committee.
  • 04SIMULATION does not accept uncertainty or create a SEAL.
See how SIMULATION, BRIDGE and SEAL separate exploration, admissibility and finality

IV / RESOLVE OR REMODEL

A blocked Decision Space can be resolved — or deliberately remodelled.

21

Path A: Resolve the current Decision Space

What would need to change for this exact Decision Space v1 to be reassessed under its existing rules?

  • 01Updated stressed market-depth evidence
  • 02More detailed exit-capacity analysis
  • 03Stronger hedge-capacity evidence
  • 04Refreshed 24h / 48h / 72h stress scenarios
  • 05Independent validation of key assumptions

22

Path A can also examine interventions inside the same Space

  • 01Additional hedge components
  • 02Tighter monitoring frequency
  • 03Defined reduction milestones
  • 04Operational execution controls
  • 05Additional escalation conditions

As long as the original Decision Question, material scope and underlying configuration remain the same, this is CURRENT-SPACE RESOLUTION — not a Space Remodel.

23

Path A has no predetermined outcome

Outcome

A1 — Evidence supports v1

Meaning

Decision Space v1 can be reassessed

Outcome

A2 — Evidence does not support v1

Meaning

v1 remains blocked

Outcome

A3 — Not recoverable under current constraints

Meaning

SEAL not reachable under current constraints

SIMULATION does not optimise for approval.

24

Path B: Remodel the Decision Space itself

What would need to change about the decision itself for another rule-bound Decision Space to exist?

Candidate

B1 — Reduced Scope

Changed decision

Only part of the originally intended exposure is taken

Candidate

B2 — Hedge-First Execution

Changed decision

Defined mitigation occurs before additional exposure

Candidate

B3 — Staged Client Facilitation

Changed decision

Exposure is divided into controlled stages with new decision gates

None of these alternatives is a recommendation from Epistemis. SIMULATION examines their consequences.

25

Staged Client Facilitation is examined further in this case

BOUNDED STAGE 1

↓

MANDATORY HEDGE / DISTRIBUTION CONDITION

↓

NEW INDEPENDENT RISK REVIEW

↓

STAGE 2 ONLY IF CONDITIONS REMAIN SATISFIED

26

Remodeling can change several dimensions at once

Dimension

Scope

Effect

The full position is no longer built immediately

Dimension

Sequence

Effect

Risk reduction and review occur before further exposure

Dimension

Reversibility

Effect

A stop remains possible between stages

Dimension

Evidence

Effect

Stage-specific evidence becomes necessary

Dimension

Authority

Effect

The changed Space needs authority for the new configuration

Dimension

Monitoring

Effect

Stage conditions and stop triggers must become observable

An alternative does not merely change the outcome. It changes the Decision Space.

27

Hard constraints may not disappear through Remodeling

HARD CONSTRAINTS — PRESERVED

Only components of the concrete enterprise decision that may actually be changed under the applicable governance framework are remodelled. SIMULATION may change scope or sequencing. It may not turn a hard constraint into an optional parameter.

When Decision Space v1 cannot close, SIMULATION can either examine how to resolve the current Space or propose a different rule-bound Space. A Remodel Candidate remains exploratory. BRIDGE controls whether a fixed new Space may proceed to SEAL review, while the blocked v1 state remains preserved.

DECISION SPACE v1

Full Client Facilitation · €50m · 72H

BLOCKER / B-01

Stressed exit / risk-reduction capacity not sufficiently characterised

SIMULATION

01 / Resolve current space

  • Stressed-liquidity evidence
  • Hedge capacity
  • 24 / 48 / 72h risk evidence
  • Reduction milestones

02 / Remodel Decision Space

  • Reduced Scope
  • Hedge-First Execution
  • Staged Client Facilitation — selected for further examination

SPACE REMODEL CANDIDATE

Staged Client Facilitation

60% initial scope · 24h initial window · new evidence · new conditions · new authority event

Materialise new governed space

Historical state preserved

v1

NOT FINALISABLE

BRIDGE

Classification · version · space delta · hard constraints · evidence inheritance · authority · challenge · conditions · blockers

DECISION SPACE v2

Staged Client Facilitation

60% initial scope · €42m temporary limit · 24h window · hedge condition · Stage-2 gate · stop trigger

SEAL CHECK

Are all required states resolved for Decision Space v2?

ADMISSIBLE OUTCOME

Bound Decision State

LEGITIMATE OFF-RAMP

NO SEAL — required state remains open

V / FROM v1 TO v2

A changed decision needs its own complete state.

28

Decision Space v1 remains historically preserved

DECISION SPACE v1

FULL CLIENT FACILITATION · €50m · 72H

STRESSED EXIT CAPACITY — NOT SUFFICIENTLY CHARACTERISED

INDEPENDENT CHALLENGE — BLOCKING

NOT FINALISABLE

The later existence of another admissible decision does not make v1 retrospectively approvable.

29

A Space Remodel Candidate is not yet Decision Space v2

  • 01Stage-1 scope must be fixed
  • 02Temporary limit and validity must be defined
  • 03Hedge and monitoring conditions must be bound
  • 04Stage-2 conditions and stop triggers must be explicit
  • 05Authority over the changed structure must be established

SPACE REMODEL CANDIDATE

≠

GOVERNED DECISION SPACE v2

30

The illustrative Decision Space v2

Dimension

Decision

v2

Staged client facilitation

Dimension

Initial scope

v2

60% of the original warehouse position

Dimension

Ordinary internal limit

v2

€40.0m

Dimension

Temporary limit

v2

€42.0m

Dimension

Initial validity

v2

24 hours

Dimension

Modelled stress loss after Stage 1

v2

€40.8m

Dimension

Hedge condition

v2

Mandatory before or with Stage 1

Dimension

Stage 2

v2

Only after a new Risk Review

Dimension

Stop condition

v2

No further exposure if conditions fail

Dimension

Hard constraints

v2

PRESERVED

These values are entirely illustrative. They do not describe actual bank practice or a supervisory requirement.

31

v1 and v2 are different decisions

Dimension

Transaction Scope

v1

100% immediately

v2

Staged

Dimension

Temporary Limit

v1

€50m

v2

€42m

Dimension

Initial Duration

v1

72h

v2

24h

Dimension

Exposure Build

v1

Full upfront

v2

Staged

Dimension

Review

v1

Original approval process

v2

New review before Stage 2

Dimension

Evidence Need

v1

Full-position 72h exit capacity

v2

Stage-1 evidence + Stage-2 gate

v2 is not a smaller version of v1. It is a different decision configuration.

32

Evidence may be inherited, but not blindly

Trade identity, the risk-limit policy, limit registry, business rationale, baseline risk run, hard constraints and original portfolio data may remain relevant. v2 also needs Stage-1-specific risk evidence, updated hedge capacity, refreshed liquidity evidence, monitoring, Stage-2 conditions, stop controls and a new independent challenge.

EVIDENCE INHERITANCE ≠ AUTOMATIC VALIDITY

33

Uncertainty changes as well

v1 asks whether the full position can be reduced in a controlled manner over 72 hours. v2 asks whether the staged structure can operate within its defined Stage Conditions. New uncertainty arises around hedge slippage, liquidity deterioration, failure of distribution after Stage 1, market movement between gates and Stage-2 projections.

34

BRIDGE examines the entire state transition

  • 01Classification — what is the new decision?
  • 02Version — are v1 and v2 clearly separated?
  • 03Space Delta — which components changed?
  • 04Hard Constraints — were non-remodelable constraints preserved?
  • 05Evidence Inheritance — which v1 evidence remains applicable?
  • 06New Evidence — what additional evidence does v2 require?
  • 07Authority — does the competent authority cover this configuration?
  • 08Independent Challenge — has v2 itself been challenged?
  • 09Conditions — are scope, duration, Stage Gate and Stop Trigger unambiguous?
  • 10Blocker Integrity — does the historical v1 blocker remain preserved?

There is no direct path: SIMULATION → SEAL.

35

Decision Space v2 receives its own complete state

Dimension

Decision Identity

State

RESOLVED

Dimension

Stage-1 Scope

State

BOUND

Dimension

Temporary Limit

State

BOUND

Dimension

24h Validity

State

BOUND

Dimension

Stage-1 Risk Position

State

CHARACTERISED

Dimension

Hedge Condition

State

BOUND

Dimension

Stage-2 Gate

State

BOUND

Dimension

Stop Conditions

State

BOUND

Dimension

Independent Challenge

State

RESOLVED

Dimension

Approval Authority

State

EXERCISED

Dimension

Residual Uncertainty

State

CHARACTERISED / MONITORED

Dimension

Blocking Objections

State

NONE

Dimension

Finality

State

ELIGIBLE FOR SEAL REVIEW

36

v2 is not automatically sealable either

DECISION SPACE v2 IDENTITY — FIXED

STAGE-1 SCOPE — BOUND

TEMPORARY LIMIT — BOUND

VALIDITY PERIOD — BOUND

RISK EVIDENCE — SUFFICIENTLY CHARACTERISED

HEDGE CONDITION — BOUND

STAGE-2 CONDITIONS — BOUND

STOP / ESCALATION TRIGGERS — BOUND

INDEPENDENT CHALLENGE — RESOLVED

APPROVAL AUTHORITY — EXERCISED

HARD CONSTRAINTS — PRESERVED

BLOCKING OBJECTIONS — NONE

A narrower or staged Decision Space is not a shortcut to finality. It creates its own requirements.

37

What SEAL holds for v2

SEAL does not state that €42 million is objectively safe, that the bank made the commercially best decision, that a regulator approved the transaction or that the position will be reduced without loss. It holds the governed state under which the organisation made this specific decision.

VI / LATER REVIEW

Later, not only the breach must remain visible. The decision basis at the time must remain readable.

38

An audit trail alone does not answer the relevant questions

Risk systems, trading systems, emails, committee papers and workflow logs may show that a limit existed, that it was breached, that an exception was requested and that a resolution took place. They do not automatically explain which evidence existed at T0, which uncertainty remained, why v1 was blocked, what changed in v2 and which authority acted on which state.

39

T0: What was true at the time of decision?

  • 01Which internal limit and policy version applied?
  • 02Which position and risk run were being considered?
  • 03Which evidence was sufficient and which remained missing?
  • 04Which assumptions and uncertainties were visible?
  • 05Which objections and alternatives were known?
  • 06Why was v1 blocked and why did v2 emerge?
  • 07Which authority approved v2 and under which conditions?

Later review begins after the decision. Traceability must be secured while the decision is being formed.

40

T1: Which questions may arise later?

  • 01Which internal limit actually applied?
  • 02When did the actual or prospective breach become visible?
  • 03Which evidence on stressed exit capacity existed at the time?
  • 04What position did Independent Market Risk take?
  • 05Why was Decision Space v1 not finalised?
  • 06Which alternatives were seriously examined?
  • 07Why was Staged Client Facilitation taken forward?
  • 08Which additional evidence and authority did v2 require?
  • 09Were the Stage and Stop Conditions actually satisfied later?

The central question is not only: Was there an approval? It is: Which Decision State actually supported that approval?

Discuss later-reader, evidence and disclosure questions in the Institutional Dialogue

41

An existing SEAL does not silently expand with the position

Change Trigger

Stress loss reaches or exceeds the temporary limit

Possible consequence

Stop / new Decision State

Change Trigger

Validity period expires

Possible consequence

No automatic continuation

Change Trigger

Hedge fails

Possible consequence

Reassessment

Change Trigger

Liquidity deteriorates materially

Possible consequence

Reassessment

Change Trigger

Stage-2 Conditions fail

Possible consequence

No Stage 2

Change Trigger

Position scope expands

Possible consequence

New Decision Space

Change Trigger

Risk policy or limit changes

Possible consequence

Reassess requirements / authority

42

Real authority remains outside Epistemis

  • 01Epistemis does not set Market-Risk limits.
  • 02Epistemis does not independently determine the economically correct risk appetite.
  • 03Epistemis does not decide whether a bank should take a position.
  • 04Epistemis does not replace the Independent Risk Function or Risk Committee.
  • 05Epistemis does not independently determine legal applicability or approve regulatory exemptions.

Epistemis preserves the governed basis on which the competent authority acted.

43

Why this case goes beyond conventional limit and workflow management

Banks already operate risk engines, limit systems, position and trading systems, Risk Appetite Frameworks, committee processes, approval workflows, stress testing, reporting, audit logs, policies and document management. Epistemis does not replace these systems.

The problem exists at another layer: how are limit state, exposure, risk evidence, uncertainty, assumptions, alternatives, independent challenge, conditions and approval authority connected into a governed Decision State that can be understood at T0 and reconstructed at T1?

44

The full Epistemis mechanism in four statements

  • 01A blocker explains why the current Risk-Limit Decision Space cannot close.
  • 02SIMULATION examines either what is missing to resolve the current Space or what different rule-bound decision could arise through a Decision-Space Remodel.
  • 03BRIDGE examines which requirements, evidence, uncertainties, conditions, authorities and state changes from exploration may return into a governed new Decision Space.
  • 04SEAL holds only a Decision State whose defined finalisation conditions are satisfied and in which no blocking state remains open.

This is not an automated limit-approval system. It is Decision-State infrastructure for a liability-exposed risk decision.

SOURCES / METHOD

Source and methodology note

Real domain and regulatory context

The domain reality of this dossier is grounded in the Capital Requirements Directive, the EBA Guidelines on Internal Governance, ECB SREP methodology for Internal Governance and Risk Management, ECB Market Risk methodology, the Basel Framework and, for the German context, the applicable MaRisk framework. These sources support the general statements about risk governance, limits, breach escalation, independent challenge, stress testing, monitoring, follow-up and management responsibility.

Illustrative scenario

Trusted Bank SE, EUR Credit Trading, the client-facilitation transaction, all limit and utilisation values, the 72-hour exception, internal roles, the Delegation Matrix, evidence states, blocker, Remodel Candidates, the 60% Stage-1 scope, the €42.0m v2 limit, the 24-hour window and all Stage, Hedge, Monitoring and Stop Conditions are illustrative. They do not describe a real bank, real transaction, supervisory finding or prescribed approval structure.

Epistemis modelling

Decision Space, Decision State, blocker, Current-Space Resolution, Decision-Space Remodel, Space Remodel Candidate, SIMULATION, BRIDGE, SEAL, v1/v2, State Preservation and Evidence-Pack views are Epistemis concepts. They are not terminology defined by Basel, the ECB, the EBA, CRD or MaRisk.

Which risk-limit decision would your organisation need to explain later?

An Enterprise Pilot starts with one clearly bounded liability-exposed risk decision and defines the authoritative limit, relevant exposure, source systems, evidence requirements, hard constraints, uncertainties, assumptions, independent challenge, alternatives, accountable roles, approval authority, blockers, permissible remodel components, monitoring, change triggers and later reader views.