tegwick
f9cba6fb35
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10238-7ecc-78e2-903d-075f50e913cc
24 lines
1.5 KiB
Markdown
24 lines
1.5 KiB
Markdown
# Evidence and decision binding
|
|
|
|
access-engine's decision envelope identifies exact request binding, provenance,
|
|
policy/fact versions, effect and lifetime. Required human approvals are separate
|
|
approval-engine objects, with consume-before-effect semantics where applicable.
|
|
The PEP owns verification and outage behavior. Knowledge receipts only show
|
|
which orientation package and sources were consulted.
|
|
|
|
audit-core is evidence custody, not the source of every event. Integrity after
|
|
arrival does not prove no event was omitted before arrival. A load-bearing source
|
|
needs its own emission guarantees and reconciliation; use the source owner's
|
|
contract. Route a missing-event investigation to the emitting source owner,
|
|
whose identity must be resolved if unknown. audit-core can verify custody after
|
|
arrival; it cannot establish that a source emitted every required event.
|
|
No record cannot be interpreted as no event. Local files are not
|
|
independent append-only custody merely because an agent did not edit them.
|
|
|
|
Keep identity/task/grant/effect attribution reconstructable without secret
|
|
values. The Statehub read model records work and decisions for coordination;
|
|
it is not runtime approval authority. Missing evidence should be produced by
|
|
legitimate tests or checks, or escalated. Do not claim observation, signature
|
|
verification, live readiness, or owner assent from a reference fixture.
|
|
|
|
Source owner IDs (cite the relevant owner, not an invented umbrella): `audit-core`, `access-engine`, `approval-engine`, `net-kingdom`.
|