Why Three Bearings

Two sextant readings give ambiguity. Three give a fix.

At sea, two bearings on a map don't fix your position — they give you two candidate locations where the lines intersect consistent with the readings. You know you're somewhere in this range, but not exactly where. Three bearings resolve the ambiguity. The point where all three converge is your fix.

The same is true in compliance auditing. Two sources of judgement can agree or disagree, but when they disagree you have two opinions and no resolution. Three independent perspectives resolve the ambiguity. That's why our audit teams are triumvirates, not pairs.

The three roles

Each triumvirate has three agents with distinct jobs:

Developer

Compares implementation against reference. Identifies what differs. Answers: "how does this code diverge from the reference implementations in other languages?"

Documentation

Deep-dives the authoritative specifications. Knows what the code should do. Answers: "what does the spec actually require?"

Mediator

Cross-checks the other two. Surfaces tension, ambiguity, and cases where the spec itself is wrong. Answers: "when the reference and the spec disagree, which is right — and why?"

Why two isn't enough

With just developer and documentation, when they agree, you have consensus. But when they disagree — which happens often — you can't resolve it. The reference implementation might have drifted from spec. The spec might be ambiguous. The implementation might be deliberately correct but unfamiliar.

Without a third perspective, every disagreement is a deadlock. The mediator is the third sextant reading that triangulates truth.

The quorum layer

Above the triumvirates sits a project council of ten specialists. Every finding goes to a vote. The threshold isn't majority — it's ≥7 of 10.

• <7 agree: severe ambiguity. Isolate for explicit decision.
• ≥7 agree: strong consensus. Accept with action.
• 10 agree: unanimous. Immediate action.

Note the inversion. A dissenting minority doesn't lose — it triggers escalation. If three or more specialists think a finding is wrong or unclear, that's a signal, not a vote to discard. The system takes disagreement seriously instead of crushing it under majority rule.

The independent auditor

One more agent sits outside the triumvirate/council structure: the auditor. Its job isn't to evaluate findings — it's to evaluate coverage. For every file in the codebase, the auditor asks: did someone examine this for compliance, or did they just use it without checking?

• Compliance: a triumvirate examined the inner workings against spec.
• Usage: a triumvirate used the code but didn't verify internals.
• Overlap: multiple triumvirates examined the same code for compliance — may indicate scope overlap.
• Gap: nobody examined it for compliance — may indicate a blind spot.

The auditor reports GREEN / YELLOW / RED traffic-light percentages across the codebase. Its findings cannot be vetoed by the council. Independent coverage tracking is how we know the audit itself is complete.

Why this structure matters

Most audit processes use a single reviewer or a pair. Both have predictable failure modes:

• Single reviewer: blind spots are invisible. The reviewer doesn't know what they don't know.
• Pair: disagreement has no resolution mechanism. Deadlock or capitulation.

Three independent perspectives, a quorum-weighted council, and an auditor tracking coverage — this is the minimum structure that produces reproducible results. Our two completed audits generated 137 and 134 findings respectively. Same scale, same classes of finding, same methodology. That's a repeatable process, not a lucky run.

The sextant is a good metaphor. It's also literally what's happening. At sea or in code, you need three reference points to know where you actually are.