01 / The operating case
What changes in a real workflow?
A reviewer approves transfer to vendor A, then the agent substitutes vendor B before payment submission.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Bind approver entitlement, task, operation, amount, currency, immutable payee, request hash, expiry and use count; recheck at executor.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A generic approval flag authorizes a mutated or unrelated payment.
Evidence to retain
Store displayed request digest, approver, consumption state, executor attempt and settlement.
04 / Canonical scope
Why this reference stands alone
Approval expiry handles time specifically; this guide owns complete action binding.
Illustrative implementation artifact
Approval binding tuple
approvalDigest = hash(approver, task, action,
immutableTarget, normalizedAmount, currency, payee, expiry)
executor compares digest and consumes approval atomicallyPrimary references