01 / The operating case
What changes in a real workflow?
A facility monitoring agent loses connectivity to its decision service. Telemetry reads may be locally authorized, but changing a set point requires a fresh approval and current operating state.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Predefine action classes, locally verifiable grant freshness, maximum offline duration and a safe mode. Deny high-impact writes and surface the dependency failure to an operator.
03 / Failure and evidence
What goes wrong, and what can be proven?
The runtime continues writes under a broad cached decision because it treats service outage as a performance issue rather than a loss of authority facts.
Record the outage, local grant state, selected mode, attempted actions, denials, operator intervention and reconciliation after connectivity returns.
04 / Canonical scope
Why this reference stands alone
Fail-closed behavior defines the denial default; this reference owns the permitted reduced operating envelope and transition rules.
Implementation review
Mode contract
NORMAL: inspect + authorized write. AUTHORITY_UNAVAILABLE: inspect only with locally verifiable, unexpired task scope. LOCAL_STATE_STALE: no production write. RESTORED: reconcile attempts before resuming.
Adversarial check
Disconnect the decision service after a cached write ALLOW. A set-point change should fail even if a telemetry read remains possible.
Primary references