TLDR

1. Desirability asks whether the outcome matters to affected people and an operating owner, and whether changed work will be accepted.
2. Feasibility asks whether the configured system performs on representative cases, integrates, recovers and remains viable at full production cost.
3. Governability asks whether the organisation may run it with lawful purpose, assigned authority, contestability, monitoring, change control and withdrawal.
4. The three tests do not compensate: two passing receipts cannot make the third pass, and no blended readiness percentage is valid.
5. Run discovery concurrently in one cross-functional team, but preserve three acceptance bars and one authorised next action.

Users love a model and representative testing shows high accuracy. Nobody can identify who may override its output, who accepts residual risk or how the system will be withdrawn. Is the proposition 80 per cent ready, or unready for consequential use?

For that proposed operating boundary, it is unready. Desirability and feasibility receipts can be strong while governability fails. Averaging the three converts a missing condition into a discount. The system may continue in a bounded, non-consequential test designed to produce the missing authority and control evidence, but it cannot borrow permission from user enthusiasm or technical performance.

The opposite failures matter just as much. A compliant, monitored summariser can be technically reliable yet add review work and solve no outcome people value. An attractive customer concept with a sound control path can fail multilingual, vulnerable-customer or latency conditions. These are not lower versions of one readiness variable. They are different causal claims with different owners, evidence and remedies.

Desirability concerns the affected population, unmet outcome, current alternative, behaviour, burden, distribution of benefit and harm, and the owner who can capture value. Feasibility concerns a bounded task, representative distribution, failure slices, integration, performance, recovery, exception work, production cost and change dependency. Governability concerns role, law, policy, intended purpose, authority, contestability, monitoring, incident response, controlled change and withdrawal.

Separate tests need not create separate departments or sequential review. The same product, operations, design, data, engineering, legal, risk and affected-person expertise can work concurrently. Separation is epistemic and decisional: each claim must be inspectable on its own evidence, signed by an accountable owner and unable to compensate for a failed neighbour.

The practical advantage is diagnostic resolution. A blended score tells a steering group that something is weak but obscures which theory failed. Three receipts preserve the path from claim to evidence to remedy. They also stop political bargaining from quietly exchanging unlike quantities: a popular interface cannot offset an unavailable appeal route, and a mature control catalogue cannot offset a service that customers avoid. The gate therefore disciplines investment as well as risk. Money follows the next uncertainty that could change the decision, rather than the most visible team or the easiest metric.

Figure 1. Three laboratories test outcome, system and authority in parallel

Test benches

01 · Non-compensationEach test answers a different decision

Desirability, feasibility and governability are separate acceptance tests because each can independently make consequential operation unjustified, ineffective or impermissible. A portfolio should not ask how much of an overall score each contributes. It should ask which receipt exists, which evidence supports it, when it expires and what action follows a failure.

Desirability begins with an outcome rather than liking. Davis's technology-acceptance work identifies perceived usefulness and perceived ease of use as important constructs for acceptance.1 They are not equivalent to captured value or safe operation. A tool can be easy and popular while shifting work downstream. A difficult change can be desirable if it materially improves an outcome and burden is addressed.

Goodhue and Thompson's task-technology fit model connects technology, task requirements, utilisation and performance.2 This helps distinguish attraction from fit. Representative observation should show what people do now, which outcome they cannot achieve, what the proposed change asks of them and why they would switch. Include people affected by the decision, not only purchasers and operators.

Feasibility is the configured system, not the model in isolation. It includes prompts, retrieval, rules, interfaces, human review, vendor services, latency, throughput, monitoring and recovery. Benchmark accuracy can be useful, but it does not establish performance on the local distribution or the cost of exceptions. Test conditions similar to intended operation and retain failure slices.

Governability is broader than a framework mapping. Applicable law and organisational role depend on exact facts: intended purpose, provider and deployer roles, geography, affected people, decision effect and system configuration. As of 2 September 2026, the EUR-Lex link used here exposes a consolidated EU AI Act text current to 27 July 2026 and in force, including a 2026 amendment.9 That status does not determine classification for a hypothetical system; qualified analysis must use the actual design and deployment.

Governability also includes operational control: assigned authority, evidence retention, notice where relevant, contestability, override, incident response, monitoring, withdrawal and controlled change. A policy document is not proof that these mechanisms work. The receipt should include exercised evidence, such as an appeal test, rollback rehearsal, monitoring response or decommissioning plan.

The second thought experiment reverses the first. A system passes every governance control, but employees route around it because it adds work and produces no useful outcome. Has governance succeeded? The controls may operate as designed, but the proposition fails desirability. Good governance can prevent or manage harm; it cannot manufacture an outcome worth producing.

Non-compensation does not mean every receipt has the same evidence volume or review cadence. A low-consequence drafting aid may need a light, frequently refreshed control receipt, while a system influencing access to employment or credit warrants far more exacting evidence. What remains invariant is the logical form: the organisation defines a minimum bar for each claim before seeing the result, records exceptions openly and refuses to convert a failed hard condition into points elsewhere. This protects the gate from retrospective threshold adjustment after a favoured prototype has attracted sponsorship.

Figure 2. Two open locks cannot release a third failed lock

Non-compensation

02 · Evidence receiptsGive every claim an owner, date and expiry

The desirability receipt

Define the affected population and unmet outcome. Map the value pool and who receives benefit or harm. Describe the current alternative, including informal workarounds. Observe switching behaviour under representative conditions rather than relying only on stated enthusiasm. Measure new burden, exceptions, contestability needs and downstream effects. Name the outcome or capture owner.

Desirability evidence can include case observation, service data, representative trials, revealed behaviour and counterfactual comparison. Satisfaction is one receipt, not the whole claim. Ask whether the intervention changes a consequential decision or workflow outcome and whether people can understand, challenge or leave the changed process where relevant.

A useful receipt states a baseline, a counterfactual and a distribution. The baseline records current time, quality, effort, errors and access, including work hidden in email, spreadsheets and informal escalation. The counterfactual names what would happen without this AI proposition: process repair, a rule, better search, training or no change. The distribution shows who gains, who performs new checking and who absorbs mistakes. This matters because aggregate time saved can coexist with concentrated burden on customers, junior staff or small groups. The owner signs both the outcome and the mechanism by which the organisation can retain or reinvest it.

The feasibility receipt

Bound the task, input distribution, action and interface. Establish a current baseline and test routine, rare, multilingual, adversarial, poor-quality and changing cases as appropriate. Report failure slices rather than one average. Include integration, identity, access, latency, throughput, monitoring, rollback, data freshness and rights.

Cost the residual workflow: review, escalation, correction, incident handling, model and prompt changes, vendor dependency and decommissioning. A configured system can pass laboratory evaluation and fail production capacity. State the conditions that invalidate the receipt, such as a policy revision, model version, distribution shift or upstream data change.

Feasibility acceptance should be expressed in operating units. For a retrieval assistant, that may mean supported claims per file, missed critical evidence, reviewer minutes and recovery time, not an abstract answer score. For a classifier, it may require decision-specific error costs and performance on predeclared slices. Capacity tests should include peak demand, unavailable dependencies and degraded input. A recovery drill is evidence only when an operator can recognise the fault, reach an authoritative fallback, preserve records and restore service within the promised boundary. These observations connect technical capability to a service that can actually be staffed.

The governability receipt

Record intended purpose, context, applicable role and the decision or action influenced. Identify relevant law, regulation, contract, policy and rights with source and date. Assign decision authority, system authority and residual-risk acceptance. Define notice, explanation, contestability, human review, override, incident response and remedy where the context requires them.

Specify what is logged, retained and auditable; who monitors which indicators; who can pause, roll back or withdraw; and how changes are classified and approved. ISO/IEC 42001:2023 provides requirements for an organisational AI management system and continual improvement, but using or certifying a management system does not itself prove product legality, fitness or control effectiveness.11

The governability receipt should separate the authority to use AI from the authority to make the underlying decision. A service owner may approve a retrieval component but have no mandate to alter a credit decision, employment recommendation or clinical pathway. The receipt maps both authorities, the hand-off between them and the conditions under which a person must intervene. It also names who accepts residual risk and who can order withdrawal. Where an appeal exists, the team tests whether the appellant reaches someone with information, independence and power to provide an effective remedy, rather than merely receiving another model-generated answer.

Figure 3. Each receipt records a different claim and expiry

Receipt anatomy

Receipts should cite one shared proposition definition. If the action boundary changes, all three may need re-review. A recruitment assistant that merely drafts outreach is not the same proposition as one that ranks applicants. A credit assistant that retrieves evidence is not the same as one that approves. Version the intended purpose, population, data, model, workflow and authority.

Use conditional language. A feasibility receipt might pass for English-language routine documents while failing handwritten or multilingual cases. Governability might pass for internal evidence preparation and fail for automated consequential action. Desirability might pass for analysts and remain unresolved for affected customers. The authorised scope is the intersection of the precise receipt conditions, not an abstract product label.

Figure 4. Concurrent discovery braids work without blending acceptance

Team topology

03 · Worked propositionsCredit evidence and recruitment boundaries

Commercial-credit file assistant

The proposition assists analysts by identifying missing evidence, extracting candidate values, retrieving relevant policy and drafting a cited preparation note. It does not approve credit. That boundary must remain identical across receipts. A later proposal to recommend or execute approval is a new proposition requiring fresh tests.

Desirability evidence starts with late evidence requests, rework, analyst readiness, queue time and the burden on customers and staff. Observe whether analysts use the evidence pack, whether requests occur earlier and whether the change improves preparation without shifting work to customers. The capture owner must be able to redesign intake or allocate released analyst capacity.

Feasibility tests representative document types, financial periods, poor scans, policy versions, entities, languages and exception classes. Extraction should preserve source location and uncertainty; calculations should remain versioned and deterministic where appropriate. Measure latency, false alerts, review, correction, integration, recovery and cost. An average document score cannot hide material failure slices.

Governability records intended purpose, data rights, access, evidence retention and the boundary between assistance and credit authority. The authorised officer remains responsible for consequential judgement. Monitoring should detect source failures, unsupported outputs, drift and boundary creep. Operators need a tested route to disable or withdraw the service while preserving the official process.

Suppose the assistant cuts preparation time but creates a queue of low-confidence extracts. The desirability receipt must count that review queue; feasibility must identify which document and policy slices generate it; governability must ensure the official record distinguishes source facts, system suggestions and officer judgement. The remedies differ. Better intake may repair value, specialised extraction may repair performance, and a provenance-preserving interface may repair control. Calling the proposition simply “promising” would conceal those choices and make the next tranche of spend arbitrary.

Figure 5. One credit assistant faces three different benches

Worked receipts

Employee and recruitment assistant

Recruitment labels conceal several propositions: drafting adverts, answering candidate questions, scheduling, summarising application evidence, ranking candidates and making selection recommendations. Each changes the three tests. The organisation must analyse the exact use, role, geography, affected people and decision influence rather than assuming one classification for an “HR copilot”.

Desirability includes both recruiter and candidate outcomes. Faster processing can be useful, but candidates may bear opacity, accessibility burden or reduced opportunity to present context. Measure completion, time, quality, candidate experience, contestability and distribution across relevant groups. A hiring manager's enthusiasm is not the whole outcome receipt.

Feasibility tests the local language, role, qualification, format and group distributions. Average agreement with historical decisions can reproduce a questionable baseline and does not prove better selection. Evaluate construct validity, error slices, calibration where applicable, robustness to missing or unusual evidence, human review and the downstream decision response.

Governability must be fact-specific and current. The EU AI Act contains provisions for prohibited practices and high-risk systems, including employment-related contexts, with obligations depending on classification and operator role.9 Other data protection, employment, equality, consumer and sector rules may apply. The paper does not classify a hypothetical system. It requires qualified review of intended purpose, roles, notice, human oversight, record-keeping, contestability and fundamental-rights effects before consequential operation.

Historical agreement is especially weak evidence for ranking. It may show that a system reproduces past choices, not that the choices measured job-relevant capability or distributed opportunity appropriately. A desirability test therefore specifies the employment outcome and affected-person experience; feasibility tests whether available evidence represents the construct across relevant cases; governability tests whether the intended influence, oversight and challenge route are acceptable. If the organisation cannot define the construct or cannot create an effective control boundary, gathering more candidate data is not progress. The correct action is to narrow or reject the proposition.

Figure 6. Recruitment value, performance and rights remain separate

Boundary map

04 · Strongest rivalIntegrated teams should not create late vetoes

The strongest rival says product value, technical delivery and governance must be considered together. Separate workstreams can optimise their own artefacts, throw work over walls and discover incompatibility after build spend. A governance review at the end becomes a late veto because the proposition was never designed to be governable.

This rival is correct. The correction is concurrent discovery with independent acceptance, not sequential departmental gates. Legal and risk expertise should shape the intended purpose and data route while designers observe affected users and engineers test representative cases. Operations should expose workflow and withdrawal constraints before architecture hardens.

Use shared checkpoints for proposition version, cases, failure taxonomy and change review. The desirability team needs feasibility evidence to understand burden; feasibility needs governance constraints to test the right configuration; governance needs affected-person evidence to assess context. Their receipts refer to one proposition but remain separately readable.

NIST's AI RMF Core integrates intended purpose, context, affected populations, validity, safety, human configuration, feedback, monitoring and decommissioning.7 Its actions are not a checklist and do not prescribe one universal tolerance. The Manage Playbook asks whether intended purpose is achieved, whether AI is the right solution and how to disengage.8 These practices support a concurrent team without creating a blended readiness number.

The rival wins against “throw it over the wall” sequencing. It does not defeat separate receipts. Indeed, independent bars make integration more useful: teams can see whether a design change repairs one test while breaking another. The change log shows which receipts expire and which owners must reaccept.

A practical operating rhythm uses one evidence review, not three presentation ceremonies. The team first freezes the proposition version, then places observations under the claim they can support. Contradictory evidence remains visible. Each receipt owner states pass, discover or redesign, together with scope and expiry. Only after those three statements does the accountable sponsor choose the authorised action. This sequence prevents the sponsor's preferred action from shaping the evidence interpretation, while allowing specialists to question one another's assumptions in the same room.

Figure 7. The late-veto funnel spends before governability is tested

Anti-pattern

05 · Executable instrumentOpen only the next authorised door

The Three-Receipt Gate evaluates one versioned proposition. Four inputs belong to each receipt. The instrument does not add them across tests. It returns three status lines and one next action. A hard failure redirects design; an incomplete but safe test can receive bounded discovery.

Three-Receipt Gate

Assess one intended purpose, population, configuration and operating boundary. “Pass” means sufficient evidence for the stated gate, not universal approval.

Desirability receipt

Outcome evidenceNo consequential outcomeClaim or stated enthusiasmObserved representative needComparison shows outcome change

Affected populationPopulation undefinedPrimary user onlyUsers and affected people mappedDistributional evidence tested

Adoption and contestability burdenAdds unowned burdenBurden acknowledgedWorkflow and challenge route designedBehaviour and burden observed

Outcome and capture ownerNo accountable ownerSponsor lacks change authorityOwner can change the outcomeCapture action approved and tracked

Feasibility receipt

Representative performanceNo bounded representative testDemo or average benchmarkTarget cases and failure slicesOperating evidence under drift

Integration and recoveryNo viable route or recoveryIntegration assumedBounded route and rollback definedThroughput and recovery tested

Full production costCost excludes residual workBuild and model cost onlyReview, change and lifecycle rangeCost observed at target volume

Exception loadExceptions unboundedKnown but unmeasuredMaterial exceptions costedCapacity and severe cases tested

Governability receipt

Lawful purpose and roleImpermissible or unanalysed purposeInitial mapping onlyFact-specific role and law reviewedRequirements evidenced and current

Authority segregationNo decision or risk authorityRoles named, powers unclearDecision, system and risk roles assignedSegregation exercised and audited

Contestability and overrideNo effective challenge or overridePolicy exists onlyNotice, challenge and recovery designedAffected cases and override tested

Monitoring and withdrawalCannot detect or withdraw safelyIndicators proposedOwners, thresholds and rollback definedIncident and withdrawal rehearsed

Evaluate receiptsControl failureValue failureSystem failureAll receipts pass

Assumptions, hard conditions and limits

• Shared proposition: every answer concerns the same intended purpose, affected population, configured system and operating authority.
• Independent bars: the three receipt states are never averaged; each passes only when all its required evidence meets the gate.
• Bounded discovery: an incomplete receipt can be investigated without consequential reliance when exposure and stop conditions are explicit.
• Hard failures: impermissible purpose, absent consequential authority, unbounded technical exceptions or no valuable outcome require redesign rather than more scoring.
• Change control: a material change to purpose, population, model, data, workflow or authority can expire one or more receipts.
• Legal limit: the instrument does not classify a system under law, certify compliance or replace fact-specific qualified advice.
• Delivery limit: three passes support controlled delivery planning, not automatic deployment or permanent approval.

Figure 8. Three separate verdicts authorise one next action

Gate board

06 · Discovery boundaryMissing receipts can be the purpose of a bounded test

Early discovery will not have three passing receipts. That does not require either premature rejection or disguised deployment. Permit bounded tests whose purpose is to produce one missing receipt. Specify the unknown, representative evidence, non-consequential boundary, owner, expiry and stop condition.

A desirability probe may observe whether users switch and whether affected people experience new burden. A feasibility probe may test multilingual exceptions, recovery or residual review without informing live decisions. A governability probe may rehearse override, appeal, monitoring and withdrawal using synthetic or historical cases under an approved boundary.

Negative control one is recruitment screening that users find useful and engineers measure as accurate, while no lawful and contestable high-risk design exists. It does not enter consequential use. Negative control two is a compliant, reliable summariser that adds review and changes no valued outcome. It fails the proposition. Negative control three is an attractive service concept with a clear control route that fails representative vulnerable-customer cases. It fails the system.

The failure response should be specific. Redesign the proposition when the outcome is unwanted or uncaptured. Redesign the technical system when performance, integration, exception burden or cost fails. Redesign authority and control when purpose, roles, contestability, monitoring or withdrawal fails. Stop when no bounded experiment can produce decision-relevant evidence.

Do not describe an all-pass result as permanent. Receipts expire. A model update, new data source, population shift, jurisdictional change, workflow redesign or altered decision influence may invalidate evidence. Continual monitoring should detect when the proposition has moved outside its accepted conditions and trigger re-test or withdrawal.

Discovery itself needs a receipt-sized decision. Before a probe begins, write the proposition version, the uncertainty being reduced, the observation that would discriminate between alternatives and the action attached to each result. Limit data, people, duration and decision influence. A test that merely accumulates demonstrations without changing a gate status is activity, not learning. At the end, archive the evidence with its conditions, including negative results. The result can pass a receipt, direct redesign, justify another sharply bounded test or stop the proposition. It cannot silently become permission for operational reliance.

07 · ConclusionThree receipts, one accountable decision

Desirability, feasibility and governability protect different truths. The first asks whether an outcome is worth producing and accepted. The second asks whether the configured service can deliver it on representative conditions. The third asks whether the organisation may operate and control it. Two truths cannot compensate for the third.

Keep the team integrated and the evidence separate. Share the proposition, population, cases and change log. Produce receipts with sources, owners, dates, expiry and failure actions. Reopen the relevant tests when the proposition changes. Use bounded discovery to fill missing receipts without creating consequential reliance.

This architecture makes rejection constructive. A failed value receipt redirects the proposition. A failed system receipt redirects engineering and workflow. A failed control receipt redirects authority and operating design. An all-pass result supports the next controlled delivery gate, not an unconditional launch.

The executive question is not “How ready is the use case?” It is “Which outcome, system and authority claims have independently earned a receipt, and what is the single authorised next action?” That formulation removes the seductive percentage and leaves accountability intact.

SourcesReferences

1. Davis, F. D. (1989). Perceived Usefulness, Perceived Ease of Use, and User Acceptance of Information Technology. MIS Quarterly, 13(3), 319–340.
2. Goodhue, D. L. and Thompson, R. L. (1995). Task-Technology Fit and Individual Performance. MIS Quarterly, 19(2), 213–236.
3. OECD (2025). The Adoption of Artificial Intelligence in Firms. OECD Artificial Intelligence Papers.
4. Bonney, K. et al. (2026). The Microstructure of AI Diffusion. US Census Bureau, CES Working Paper 26-25.
5. Brynjolfsson, E., Li, D. and Raymond, L. R. (2025). Generative AI at Work. The Quarterly Journal of Economics, 140(2), 889–942.
6. Dell'Acqua, F. et al. (2026). Navigating the Jagged Technological Frontier. Organization Science.
7. NIST (2023). Artificial Intelligence Risk Management Framework Core.
8. NIST (2023). AI RMF Manage Playbook.
9. European Union (2024, consolidated 2026). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. Current consolidated text accessed 2 September 2026.
10. European Commission (2026). AI regulatory framework. Implementation overview accessed 2 September 2026.
11. ISO (2023). ISO/IEC 42001:2023, Information technology: Artificial intelligence: Management system.
12. HM Treasury (2026). The Green Book 2026.
13. Kleinberg, J., Ludwig, J., Mullainathan, S. and Obermeyer, Z. (2015). Prediction Policy Problems. American Economic Review, 105(5), 491–495.
14. OECD (2025). The Effects of Generative AI on Productivity, Innovation and Entrepreneurship. OECD Artificial Intelligence Papers.