emergent-security/knowledge/cards/decisions.md

Prepare a human decision

The repository is informed-decision (singular). It owns the Decision Memo, what a human was shown, and presentation/disposition evidence. Agents draft a single concrete question, requested act, alternatives, consequences and a non-secret evidence packet. The human answers in the authenticated review surface. Do not accept, decline, acknowledge required highlights, sign, or seal on the human's behalf. A draft, review-group membership, silence, timeout, and a Statehub decision note are not a human bind or runtime approval.

Route a prepared decision packet to informed-decision for its submission/review path; ask the delegator only when the question, scope or mandate is unresolved. Verification of approval and PDP bindings belongs to the effect owner/PEP using approval-engine and access-engine, not to a new general approval by the delegator.

Keep identities distinct: original delegator, drafting agent, authenticated submitter/requester, represented principal, human reviewer, and effect actor. drafted_by is asserted provenance, not authentication. The reviewer starts as pending-human-session; the surface binds the actual authenticated subject. view_hash commits the presented binding document; awareness_hash is separate. Neither is approval-engine's binding digest or access-engine's request digest.

Current owner evidence: the browser review surface is deployed according to its dated SCOPE. INFD-WP-0006 completed the Authelia fresh-login request, with live fresh-login/p01 acceptance. An actionable browser freshness error remains open. INFD-WP-0005 has a local intake service, a schema-3 ledger, opt-in scheduled delivery, and durable notification/write-back jobs. Shipped registries are empty. A notification is a retained State Hub message to the founder with memo id, question, class, and submitter. The owner contract prohibits URLs and names the signed-in overview as the review entry. Local posed audit evidence has receipts, readiness, heartbeat, and reconciliation. The write-back flag stays off unless that runtime is explicitly enabled. No listener is deployed. Workload custody, attribute admission, submitter registration, and live rollout remain blocked. The dev forwarder accepts requires_new_bind, required_ack, and sealed, and it does not choose a service account. Do not call POST /v1/memos or treat Statehub forwarding as a live submitter route. Prepare the unsigned packet locally and use the owner's attended submission route when authorized. Never invent client credentials or register yourself as an admitted submitter. No extra human permission is needed merely to draft.

A creating approval row without a retained receipt must not be retried automatically. Gate House's reply says posing itself needs no human act. The proposed decision still awaits the founder's ruling, and that reply does not open a live submission route. A PDP allow is eligibility only: the effect owner reads the live approval and compares its id and native digest with the memo pin. Do not place view_hash in PDP context or recompute it into the engine binding digest. Intake-created approvals keep human_control true. drafted_by stays asserted provenance when a hub forwards a memo.

For a protected effect, the human disposition must be reflected in the exact approval-engine object where required; the effect owner verifies its claim, validity and consumption contract and the current access-engine decision. return and discuss leave the decision unresolved; rejection or changed scope requires revision, not an automatic retry. Acceptance does not execute a runbook.

Known evidence limits remain: the owner reports no PDP signature verification in its surface, view_hash is not inside the approval entry, and commitment-only audit custody cannot reconstruct withheld content. Local draft validation closes none of those gaps. An adoption memo can ask about this knowledge profile; it cannot also authorize root recovery, production changes or fleet control changes.

Source owner IDs: informed-decision, approval-engine, access-engine, audit-core, the-custodian.