Runtime & evidence
Execution controls and human review
Understand admission, bounded effects, release and exception handling as separate controls.
In this document
Admit only a supported operation#
Execution starts with a known operation and server-resolved authority. Registered skill and adapter contracts constrain schemas, destinations, allowed effects and execution limits. Unsupported tools, content forms or scope should fail explicitly rather than inherit an approximate permission.
An agent or specialist can propose an action, but the proposal itself cannot authorize it. Repository engineering review skills are development workflows; they do not create product execution grants.
Check the actual final artifact#
Transformation must act on the actual content that could leave the boundary. The transformed artifact is revalidated; an obligation to redact is not evidence that redaction ran. The final release path checks current authority and the exact artifact/context rather than relying only on an earlier admission result.
For ordinary deterministic payload publication, canonical decision and release audit are committed together. A changed key, policy, authority revision or enrolled project context can invalidate the pending release. A failed transaction must not leave apparently successful terminal evidence.
Use only the supported human-review path#
Exact-output review is opt-in for the named nonclinical application profile. It binds a reviewer decision to the retained encrypted artifact, original audience and still-valid grant. It is not a general-purpose pause/resume system, clinical approval or permission to change the destination after review.
A HELD result alone records no approval. Simulated Workbench overrides are teaching controls, not these production review decisions. Project execution approval is another distinct lifecycle and currently applies only to its separately enabled deterministic payload boundary.
Handle interruption and uncertain effects honestly#
Cancellation, deadlines, revoked authority and persistence failures remain operational failures or holds. They must not be relabeled as policy BLOCK decisions. If an external write has an uncertain outcome, reconciliation is required; a retry cannot promise exactly-once effects without destination support.
Ingress runs before permitted dispatch; output is checked and final authority is refreshed before atomic evidence publication and return.
Simplified sequence; ingress denial makes no provider call, while egress denial may follow execution.
Read the diagram description
Ingress runs before permitted dispatch; output is checked and final authority is refreshed before atomic evidence publication and return. Simplified sequence; ingress denial makes no provider call, while egress denial may follow execution.
Execution authority, content policy and final publication are separate gates; a hold never becomes permission through a UI override.
Current supported boundaries; public teaching simulations do not resume real effects.
Read the diagram description
Execution authority, content policy and final publication are separate gates; a hold never becomes permission through a UI override. Current supported boundaries; public teaching simulations do not resume real effects.