01 / The operating case
What changes in a real workflow?
A maintenance agent can restart only host H-7 in change window W with no more than one attempt.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Model operation, immutable target, parameter bounds, time, count, task, incident and required approval as separately testable predicates.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A broad “restart allowed” bit survives a target change and a closed window.
Evidence to retain
Retain evaluated predicates, failed constraint, envelope version and executed host state.
04 / Canonical scope
Why this reference stands alone
Authority grant captures delegated rights; the envelope is the decision-time limit on one effect.
Illustrative implementation artifact
Predicate checklist
ALLOW iff grant.active
and action == "host.restart"
and target == immutableHostId
and now in maintenanceWindow
and usesRemaining > 0
and approval matches requestDigestPrimary references