01 / The operating case
What changes in a real workflow?
A staging alias is re-pointed to production between policy evaluation and deployment.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Resolve immutable resource ID at the executor, compare the current target and request hash with the decision, and re-evaluate if either changes.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
An accurate ALLOW for staging is applied to production.
Evidence to retain
Record checked ID, executed ID, policy time, comparison and observed deployment.
04 / Canonical scope
Why this reference stands alone
Caching controls old verdicts; this guide owns mutable target identity between check and effect.
Illustrative implementation artifact
Immutable target check
checkedId = resolveAlias("staging")
decision = authorize(deploy, checkedId, payloadDigest)
executedId = resolveAliasAtExecutor("staging")
reject if executedId != checkedId
reject if hash(payload) != payloadDigestPrimary references