01 / The operating case
What changes in a real workflow?
A remote pump controller loses the network but may still close one valve to prevent damage.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Prebind device identity, valve, safety threshold, maximum uses and expiry; enforce locally with tamper-resistant state and reconcile once connected.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
An indefinite offline grant permits any valve change long after the safety event.
Evidence to retain
Retain local decision sequence, sensor evidence, effect and later central reconciliation.
04 / Canonical scope
Why this reference stands alone
Reduced-mode semantics describes policy classes; this page owns preauthorization of consequential offline effects.
Illustrative implementation artifact
Offline action envelope
{deviceId, safetyCondition, valveId, action: close,
maxUses: 1, expiresAt, localPolicyEpoch}
local decision requires sensor threshold and unused envelope
append tamper-evident event before actuationPrimary references