01 / The operating case
What changes in a real workflow?
A restart agent loses access to its policy service during a production incident.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Classify effects, deny restart on indeterminate decision, preserve low-risk reads only under separately valid local policy and escalate through a documented emergency path.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A network timeout is interpreted as approval or yesterday’s ALLOW is reused.
Evidence to retain
Log dependency failure, local mode, denied request and later reconciliation.
04 / Canonical scope
Why this reference stands alone
Degraded semantics owns alternate reduced operation; this page sets the mandatory failure default.
Illustrative implementation artifact
Unavailable-decision matrix
low-risk read + valid local grant => limited read
production write + PDP unavailable => DENY
unknown revocation state + high impact => DENY
explicit break-glass activation => separate audited pathPrimary references