01 / The operating case
What changes in a real workflow?
An agent performs many telemetry reads and occasionally submits a high-impact network change. A single timeout and cache policy for both actions either slows reads needlessly or weakens the write boundary.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Measure local validation, grant lookup, policy evaluation and dependency time separately. Cache only facts with explicit validity and revocation behavior; reserve a fresh check for high-impact writes and define timeout as deny or explicit reduced mode.
03 / Failure and evidence
What goes wrong, and what can be proven?
A performance shortcut reuses a broad ALLOW after the grant is revoked, or a timeout turns into implicit permission under load.
Record decision duration by component, cache age and key, failure mode and escaped effects; compare p95/p99 against the agreed consequence-specific budget.
04 / Canonical scope
Why this reference stands alone
Decision caching owns reuse correctness; this page owns latency allocation and measurement of the authorization path.
Implementation review
Consequence-specific budget
Telemetry read: validate short-lived local scope; monitor cache age. Production write: fresh grant and policy check, bounded timeout, deny on missing fact. Measure network, policy and executor time separately.
Adversarial check
Add 500 ms of decision-service latency and then disconnect it. The runtime may optimize safe reads; it must not skip authorization for the write.
Primary references