Setting up your CAB

The first time an owner signs in to a fresh tenant, Churchill opens a six-step setup wizard instead of the dashboard. The wizard stands up your Change Advisory Board (CAB), the group that approves every change, and seals the system baseline through their unanimous approval. Until that baseline is sealed, the CAB is inactive, the rest of the console stays gated, and protected-app registration is locked.

This ceremony runs once, and only the owner sees it. Budget about five minutes of your own time, plus however long your members take to register. Nothing is published until the final seal, so you can pause and resume freely. The wizard picks up where the ceremony actually is, even from another session.

Your invitees follow a different path. Send them Joining the CAB.

The six steps

1. Introduction

The opening screen explains the deal: Churchill won’t act on a single root, so before the dashboard opens you build the board and seal the baseline. It previews the whole flow in four steps: confirm your role, invite your members, seal the baseline, register your first app. Select Begin setup.

2. Your role

As the owner you chair the board by default. You run setup, send invitations, and seal the baseline. That part is fixed. Separately, the Participate as a voting member toggle decides whether your approval also counts toward the unanimous set.

If you participate, your signing credential is a WebAuthn passkey:

• If your account already holds a passkey, two tabs let you choose: use my login passkey promotes your existing sign-in passkey to a CAB signing key, and create a new passkey mints a separate one.
• If your account has no passkey yet, the screen notes that one is created when you continue. Your device prompts you to confirm.

Two decisions here deserve a pause:

1. Turning participation off after your key is registered removes that key. Removed keys stay dead, so participating again later means a fresh passkey ceremony.
2. The choice locks once invitations are sent. The screen shows “role locked · invitations already sent” after that point.

The screen also states the sizing rule: membership starts at 2, with no maximum. Genesis approval is unanimous and fixed. The quorum for ongoing changes is configured later, in CAB settings.

3. Members

Add each member by name, work email, and role. All three fields are required. The board needs at least two members in total, and there is no upper limit. If you chose to vote, you count as one of the two. A counter chip tracks the roster (“3 members · min 2 met”), and you cannot continue below two.

You provide identity only. You do not create anyone’s keys. Each person creates their own passkey from their invitation, and it doubles as their dashboard sign-in.

A few roster rules:

• Edit is available only until a member registers a key.
• Remove is typed-confirm gated: you type the member’s email to confirm.
• Removing a member who has already registered also revokes their pending invitation.

Select Send invitations to email everyone and move on. You can come back and add more people later. Newcomers are invited the next time you send.

4. Invitations

Each member receives a private email link, valid for seven days. This screen is live: a chip reads “live · status updates as members return”, and a tracker counts “2 of 4 registered”. As members finish, their key fingerprint and algorithm appear in the roster. Resend retires a member’s old link and mints a fresh one.

Review baseline stays disabled until everyone has registered. The hint below the roster counts how many members you are still waiting on, and each roster row shows where that person stands.

5. Baseline

This is the genesis baseline: the CAB registry plus the initial system state, hashed. It seals only when every member has approved. As the screen puts it, “genesis approval is all-or-nothing”. There is no threshold to lower, and the callout names anyone still outstanding.

If you participate, select Approve baseline. Your device asks you to confirm with your passkey, and your approval counts as one of the required set. Members approve from their own invitation flow.

If a member registers a key after others have already approved, the baseline hash changes and those earlier approvals no longer count against it. The console retries your own approval automatically, but expect the tracker count to drop until the others re-approve through their links.

Once every approval is in, the hint reads “ready to seal” and Seal baseline activates. Sealing locks the registry as the root that every future change is voted against.

6. Active

The final screen confirms it: “The CAB for your tenant is active.” The banner reads “baseline sealed · CAB active · governance chain live”. The Setup receipt card holds your permanent record of the ceremony (see below). The handoff button, Go to Protected Apps, takes you straight to registering your first protected application. See Registering an application.

What sealing changes

Sealing is the moment your tenant goes from setup to governed operation:

• Protected apps unlock. App registration and the Protected Apps page become available.
• The governance chain goes live. Every future change is a vote against this sealed root.
• All invitation links retire. Outstanding ceremony invites stop working.
• The ceremony cannot be re-run. There is exactly one genesis per tenant.

The board itself is not frozen: the owner can invite, rename, and remove members afterwards from the CAB page. See CAB overview.

The setup receipt

The receipt is the exact record of the seal, and worth keeping with your compliance evidence. Copy puts the raw JSON on your clipboard. Export .json downloads it as cab-setup-receipt-<tenant>.json. Both ship the record byte-for-byte as it was sealed, not a reconstruction.

Field	What it records
tenant	The tenant the CAB governs.
sealed at	When the baseline was sealed.
approval	The approval mode and count: unanimous, N of N.
baseline hash	The sealed genesis hash.
members	Each member with their key fingerprint and approval mark.
algorithms	The signature algorithms in use.

If you skip the export here, the receipt stays available later under Settings, on the policy tab, for owners only.