What HQ sees in Decisions and what it never sees

What this page is

Decisions is HQ's inbox for the things a franchisor actually has to decide: which network plan to activate, which at-risk franchisee needs a call, which consent request is still waiting on a response, which program audit or violation needs a ruling. It is built on the same shell as the operator-side IQ Decisions log, so it looks and behaves the same way (gallery of tiles, status filters, a slide-over for each item), but the data underneath is entirely different, and the boundary between the two is the point of this article.

HQ's Decisions log pulls together four kinds of network-level records: decision plans (the playbooks and directives HQ authors for the network), interventions (at-risk franchisees HQ is working), consent requests (HQ's own asks for narrower, named visibility into a franchisee's data), and program audits and violations (compliance judgment calls tied to a program, not a person). Every row on this page is something HQ itself created, was asked to respond to, or is judging at the program level. None of them is a franchisee's job file, invoice, or margin number. That is a structural fact about where these rows come from, not a filter applied on top: the four source tables this page reads from simply don't contain that data.

Where to find it

Open Decisions from the HQ sidebar, at hq.verinode.ai/decisions.

The four kinds of rows

Decision plans

These are the network playbooks HQ authors. Each one has a plan kind: playbook (a canonical multi-step plan), directive (a one-shot mandate), recommendation (a soft nudge with no enforcement), or experiment (a network-level A/B test). Status moves draft to active to completed, or active to paused, or any status to archived. A plan marked as a directive shows the amber warning accent on its tile; every other plan kind reads as a plain informational tile.

Decision plans carry no franchisee identity at all. entity_name is null for every row of this kind, since a plan is a network-wide instruction, not a statement about one location.

Buttons on a decision-plan tile:

• Act: activates a draft or paused plan, or completes an active one. What it does depends on the plan's current status.
• Not now: pauses an active plan. Only live once the plan is active.
• Ignore: archives the plan from any status.

Interventions

These are franchisees HQ has flagged as at-risk and is actively working. Each one carries a flag reason as its title, a lifecycle of queued, contacted, in progress, resolved (or any of those to no action), and, once set, a franchisee identity.

That identity is where the boundary shows up first. By default, HQ networks are set to Independent operators in the account's data posture (Settings), which means every franchisee name here is anonymized to a stable label like Franchisee #A1B2, a short, consistent tag derived from the operator's internal record rather than their real business name. Only networks explicitly switched to Same entity (one tax ID across every location, an enterprise multi-location operation rather than a franchise of independent legal entities) see the real location name on this tile. That switch lives in HQ Settings under Data posture, and only an admin can change it.

Interventions also carry free-text notes, whatever context HQ staff wrote down while working the case. Those notes are encrypted with the network's own key, unwrapped only when a group admin is signed in with an active session. Verinode's infrastructure has no standing way to read them: there is no master key on the server side that decrypts intervention notes on its own, only a wrapping that requires one of the network's own admins to be logged in. That is a stronger guarantee than "encrypted at rest": it means the notes are structurally unreadable outside an authenticated admin session, by design.

Buttons on an intervention tile:

• Act: advances the case one stage (queued to contacted to in progress to resolved).
• Not now: not available for interventions; there's no parked state in this lifecycle, so the button renders grayed out.
• Ignore: closes the case as no action taken.

Consent requests

A consent request is HQ asking a specific franchisee for narrower, named visibility into something that's normally anonymous. The default state everywhere else on the platform is masked aggregate: HQ sees leaderboards and rollups with no operator names attached. A consent request is the one explicit, revocable, audited channel where HQ can ask a franchisee to step out of that anonymity for a bounded purpose: to be named on a leaderboard, to let HQ see one metric for one window, to be featured in a case study, or (the broadest ask) to let HQ see job-level detail for a specific initiative.

The tile shows the request's rationale (why HQ is asking) and, in the workspace, the specific metrics involved. It never shows the underlying data itself, approved or not. If a franchisee approves a "deep data" request, whatever they agreed to share surfaces elsewhere in the platform under the scope they approved. This Decisions tile only ever displays the ask, not the answer.

Franchisee identity here follows the same rule as interventions: anonymized to Franchisee #XXXX under Independent operators, real name under Same entity.

Buttons on a consent-request tile: HQ can only withdraw its own ask before or after approval. Ignore is the one live button, and it cancels the request. Approving or declining is the franchisee's call, made on their own side; HQ has no Act button here because there is nothing for HQ to approve on a franchisee's behalf. Not now is likewise unavailable.

Program audits and violations

These are compliance findings tied to a program: an inspection cycle, a quarterly audit, a self-attestation, or a threshold violation someone or something flagged. Every row's entity_name is the program's name, never a franchisee's. Even when the underlying audit was conducted on a specific franchisee's location (audits can also target an approved vendor, carrier, or lab instead of an operator), the Decisions tile identifies which program the finding belongs to and nothing more specific than that.

Audits carry a findings note and, where scored, a numeric score; only audits awaiting HQ's ruling (submitted or disputed) show up here. Violations carry a severity (low, medium, high, critical: critical is the one severity that can push a pending tile into the red "Urgent" accent) and only show while open or escalated.

Buttons on an audit tile:

• Act: approves the audit.
• Not now: withdraws it.
• Ignore: disputes it.

Buttons on a violation tile:

• Act: resolves the violation.
• Not now: escalates it (open to escalated).
• Ignore: waives it, closing it out without treating it as resolved.

Reading a tile

Every tile in the gallery follows the same layout as the operator-side Decisions log: a colored accent bar across the top carries the status (red for urgent, amber for pending, green for acted or resolved, teal for parked, gray for ignored), a large low-opacity domain icon sits in the background, and the title is the headline. Program audits and violations get their own compliance icon; decision plans, interventions, and consent requests all share a generic default icon today.

One thing is consistently absent: the dollar hero number that anchors most operator-side decision tiles. On IQ, a decision tile leads with a dollar figure, the estimated monthly or annual impact. None of the four HQ source kinds carries a calibrated dollar estimate, so every HQ tile falls back to title-only. That's not a display bug, it's the same boundary again: this page has no franchisee cost, margin, or job-value number to show, because none flows into these four tables in the first place.

A small status pill sits top-right on pending, parked, or ignored tiles (Urgent, Pending, Parked, or Ignored). Acted and resolved tiles instead get a rotated Acted or Done rubber-stamp watermark, and their action row collapses to a single Edit plan (or Review outcome, once resolved) button that reopens the same workspace slide.

Clicking anywhere on a tile (other than its buttons) opens the same item in a slide-over workspace: the title, any body text or findings, the evidence HQ has attached, and, for decision plans and interventions, a synthesized timeline of the row's lifecycle stages. This slide-over is the deepest read HQ ever gets on any row: it is built from exactly the same four source tables and carries no additional fields. There is no drill-through from here into a franchisee's underlying job, invoice, or margin records; those simply aren't part of what this workspace queries.

Every tile also carries a Discuss control that hands the row to Verinode's agent panel for a conversation about it. Discuss reasons over what's already on the tile and in the workspace, the title, the evidence, the timeline. It does not pull in additional franchisee data that isn't already part of the row.

Filtering the board

• Search: filters by title or franchisee label (the anonymized label, if the network is anonymized).
• Status: a dropdown with a live count beside each option: All, Pending, Acted, Parked, Ignored, Resolved. Pending covers rows HQ hasn't acted, parked, or ignored yet.
• Domain: appears once the current status filter spans two or more business areas. HQ's four sources land in Operations (decision plans), Risk (interventions), Governance (consent requests), and Compliance (audits and violations), each with its own live count.
• Sort: Newest first (default) or Biggest impact. Because no HQ row carries a dollar estimate, sorting by impact doesn't meaningfully reorder the HQ board; every row ties at zero, so date order effectively holds.

The From a scan toggle that appears on the operator-side Decisions log doesn't apply here; that filter surfaces findings from the operator's own Business Analyst scans, a capability scoped to individual operator accounts, not HQ.

Empty states

With no HQ decisions of any kind on the board, the gallery reads:

No decisions for you yet. They'll land here as Verinode spots cost savings, risk, and growth opportunities in your data.

Filtering to a specific status with nothing in it reads, for example:

Nothing pending for you right now. Nothing parked for you right now. Nothing resolved for you right now.

(the pattern is "Nothing [status] for you right now," with the status filter's own label dropped in).

The privacy boundary, in one place

To summarize the rule this whole page is built around:

• Franchisee identity is anonymized by default. Every network starts on Independent operators in Settings, Data posture; interventions and consent requests show Franchisee #XXXX instead of a real name unless the account has been explicitly switched to Same entity for a single-tax-ID, enterprise multi-location operation.
• Intervention notes are encrypted under the network's own admin-only key. They only ever decrypt inside an active, authenticated admin session; there is no standing infrastructure key that can read them independently.
• Consent requests show the ask, never the data. Approving or declining is the franchisee's decision, made on their own side; HQ can only withdraw its own request from this page.
• Program audits and violations are keyed to the program, not the person. Even when the underlying finding concerns a specific franchisee's location, the Decisions tile identifies the program, not the operator.
• No job, invoice, or margin data flows through this page at all. None of the four source tables behind Decisions contains that data, which is why no HQ tile ever shows a dollar figure the way an operator-side decision does.

Franchisees own their own operational data. HQ's job in Decisions is governance, risk, compliance, and network-plan judgment calls, made on aggregates and on the network-level records HQ itself authors, never on a single franchisee's private books.

Related

• HQ overview
• Network health
• HQ benchmarks
• HQ programs
• HQ standards
• HQ compliance
• HQ report library
• Broadcasting to your network