`kings-guard`'s adaptation of the same for a repository with no Tooling
contacts at all.
**Contest the proposed layer if it is wrong.** Three repositories have returned
corrections that changed the standard; one talked us out of an exception we had
offered. A correction is worth more than a label.
## 3. The rules that bind everyone
1.**One decision point.**`access-engine` renders authorization decisions. No
other repository, in any layer, renders or caches one.
2.**Compiled data that determines an outcome is still deciding.** A registry,
cache, or schema that resolves a result before the engine runs decided early.
3.**Doctrine arrives as a claim.** Anything changing an outcome — authority
ceiling, zone stance, posture, maturity level — reaches the decision as a
request claim or a versioned policy rule. Never a side channel.
4.**Adaptive systems may only tighten.** Reduce, step up, request containment;
never manufacture authority.
5.**Staff never touches Tooling directly.** Act through Engine APIs. See §4.
6.**Every allow has a lifetime** — a TTL, or a binding to a session or
obligation that ends.
## 4. If you touch Tooling
"Tooling" means a system catalogued as Tooling in statute §4 — today `key-cape`
and `OpenBao`. Uncatalogued infrastructure (State Hub, `llm-connect`) is outside
the rule, but **list it anyway** so your conformance check is total. That
carve-out sunsets: an uncatalogued store another layer *reads* must, within two
review intervals, be catalogued or declared a gap.
| Shape | When | You must |
| --- | --- | --- |
| **Read-only diagnostic** | no engine exposes the read | declare it; no writes; it is a gap to close |
| **Conduit** | you run the *owner's* tool under the *caller's* identity | present no credential of your own, widen nothing, stay reconstructable as the caller |
| **Declared gap** | you must contact Tooling and no engine exposes it | declare `capability`, `intended_owner`, `blocked_on`, `review` — machine-readably |
A conduit presenting its own token is not a conduit. A declared gap is **tracked
non-conformance** — but declaring beats hiding, and it is never scored below
silence.
There is deliberately **no "operator of third-party Tooling" shape**. Someone
must run OpenBao, and that stays a declared gap whose review keeps returning,
because a clean operator shape would turn a tracked gap into a permanent
allowance.
## 5. If you cause side effects (you are PEP-shaped)
Being PEP-shaped does not change your layer. `ops-warden` issuing a certificate
and `ops-mason` opening a route are both Staff and both PEP-shaped.
1.**No side effect without a decision record** naming the request it was
rendered for — **or** your declared stance permits proceeding and **you record
the application of that stance in its place.** A fail-open result is metadata,
never silence.
2.**Do not replay a verdict outside its own binding and lifetime.** Within them
it is the decision being used as issued. The test is mechanical: replay is
permitted iff the canonical request digest matches and the lifetime holds.
Caching a DENY is permitted where the refusal is recorded against the request
refused and the cache lifetime is declared.
3.**Publish your unreachable-engine stance map** — total, per zone or
equivalent, no implicit default, no per-call discretion. **Publish it at a
path named in your layer declaration, and register it in statute §13.1** — a
map only you can read is not published. The published map MUST equal shipped
behaviour; assert that with a test. Reference: `ops-warden`
`ADR-0009` + `pep-stance.yaml`.
4.**Stay reconstructable**, within the bound in §6.
If `access-engine` is reachable but degraded, the fallback is the engine's. If it
is unreachable, the behaviour is necessarily yours — which is why it is declared
in advance rather than decided in the moment.
## 6. What you may never claim about evidence
An append-only archive with a verified chain proves records were **not altered or
truncated after arrival**. It proves nothing about an event never sent.
- ✗ "the audit record proves it happened"
- ✗ "there is no record, so it did not happen"
- ✓ "the archive proves the records it holds were not altered or truncated after arrival"
Which control covers which threat:
| Threat | Covered by |
| --- | --- |
| Accidental omission (crash between mutation and emit) | atomic emission via a **local** outbox — **prevented** |
| Adversarial omission (a compromised source suppresses) | cadence and reconciliation — **detected after the fact** |
| Adversarial omission at a compromised source | **nothing prevents it.** Known residual |
If a control's soundness depends on an event being present, that evidence is
**load-bearing**: emission must be atomic with the state change, queued locally,
and you **MUST** declare an expected cadence. For rare load-bearing events —
revocations, denials, containment — rate monitoring cannot work, so the required
