01 / The operating case
What changes in a real workflow?
A payment worker asks whether agent A may release $8,400 to vendor V for invoice I.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Use a typed request with issuer-verified grant, task, normalized amount and payee, policy version and contextual facts; return ALLOW, DENY or indeterminate with a bounded validity period.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
An ALLOW on broad resource “payments” is reused for a different payee.
Evidence to retain
Retain input digest, policy version, reason and decision ID; correlate with payment executor.
04 / Canonical scope
Why this reference stands alone
The PEP page owns blocking execution; this page owns evaluation inputs and decision semantics.
Illustrative implementation artifact
Decision request contract
request = {principal, originatingGrant, task,
action: "payment.release", immutableInvoiceId,
amount, currency, payeeId, policyVersion, contextTime}
result = evaluate(request)
// ALLOW | DENY | INDETERMINATE
// reason, requestDigest, decisionId, expiresAtPrimary references