Officers are quiet by default. They watch the procurement cycle, cross-reference it against your profile, and queue drafts in your inbox. You decide what ships. Here’s the loop, top to bottom.
Your Intelligence Officer runs at 06:00 Eastern, scanning every signal that came in overnight — appropriations markups, agency forecasts, RFPs, policy actions — and matches them against your profile. The output is a brief: top opportunities, policy shifts, recommended actions. It posts to your inbox and (when email is on) lands in your inbox at 06:05.
Capture, Allied Entry, Marketplace, and the rest fire when relevant signals land — an RFP scored ≥ 80, a profile change worth proposing, a US prime added to the marketplace, a committee markup matching your policy coverage. They draft what they’d do. They never do it.
Every draft is a card: the officer’s reasoning at the top, the proposed action body in the middle, the source data disclosed underneath. You can approve, edit-then-approve, send (for outbound messaging drafts), or dismiss.
Dismissals are not silent. The officer’s semantic memory tracks what you dismiss and learns: drafts that look like things you’ve rejected get filtered out before they reach the queue. Over time the inbox sharpens to what you actually want to see.
Every officer ships in Draft tier by default: it writes, you approve. Two exceptions: Intelligence Officer is read-only so it ships in Auto from day one (no mutations to gate); Profile Officer touches authoritative data so it ships in Suggest (proposes diffs you click through one by one).
When an officer’s accept rate hits 80% over 30 days with ≥ 8 tasks behind it, the inbox surfaces a “Promote to next tier” button. Trust earned, not assumed. You can also downgrade or disable any officer at any time from Settings.
When your Capture Officer finds a teaming candidate on Bridger, it doesn’t fire a unilateral outreach. It opens a coordination loop: your draft sits in your inbox, the same shared context lands on the partner side’s Marketplace Officer, and either side can accept, decline, or withdraw.
Privacy is bounded. Only data both organizations have opted-in to share at the platform level appears in the coordination payload. No unmasked customer names, no private pipelines.
Per-officer per-day caps (tokens, dollars, mutations) gate every run. Defaults are conservative; you can raise or lower them per officer in Settings. Org admins set a ceiling above the per-user sum that monitors and alerts but never starves a single user.
Two kill levels: per-officer (disable just one), org-wide (disable everything for everyone in your org). Both are one click. Levenhall ops can also flip a platform-wide kill in an incident — your data stays intact, runs just stop.