emergent-security/knowledge/cards/decisions.md

Prepare a human decision

The repository is informed-decision (singular). It owns the Decision Memo, what a human was shown, and presentation/disposition evidence. Agents draft a single concrete question, requested act, alternatives, consequences and a non-secret evidence packet. The human answers in the authenticated review surface. Do not accept, decline, acknowledge required highlights, sign, or seal on the human's behalf. A draft, review-group membership, silence, timeout, and a Statehub decision note are not a human bind or runtime approval.

Route a prepared decision packet to informed-decision for its submission/review path; ask the delegator only when the question, scope or mandate is unresolved. Verification of approval and PDP bindings belongs to the effect owner/PEP using approval-engine and access-engine, not to a new general approval by the delegator.

Keep identities distinct: original delegator, drafting agent, authenticated submitter/requester, represented principal, human reviewer, and effect actor. drafted_by is asserted provenance, not authentication. The reviewer starts as pending-human-session; the surface binds the actual authenticated subject. view_hash commits the presented binding document; awareness_hash is separate. Neither is approval-engine's binding digest or access-engine's request digest.

Current owner evidence: the browser review surface is deployed according to its dated SCOPE; INFD-WP-0005 has offline intake validation and a write-back adapter, but its listener, admission, workload custody and rollout are unfinished. Do not assume POST /v1/memos or a Statehub forwarding route is live. Prepare the unsigned packet locally; use the owner's current attended submission route when authorized. Never invent client credentials or register yourself as an admitted submitter. No extra human permission is needed merely to draft.

For a protected effect, the human disposition must be reflected in the exact approval-engine object where required; the effect owner verifies its claim, validity and consumption contract and the current access-engine decision. return and discuss leave the decision unresolved; rejection or changed scope requires revision, not an automatic retry. Acceptance does not execute a runbook.

Known evidence limits remain: the owner reports no PDP signature verification in its surface, view_hash is not inside the approval entry, and commitment-only audit custody cannot reconstruct withheld content. Local draft validation closes none of those gaps. An adoption memo can ask about this knowledge profile; it cannot also authorize root recovery, production changes or fleet control changes.

Source owner IDs: informed-decision, approval-engine, access-engine, audit-core, the-custodian.