01 / The operating case
What changes in a real workflow?
A refund service starts returning more ALLOW decisions after a policy rollout, while its downstream payment count is unchanged.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Measure verdict and reason rates by policy version and action class, trace decision-to-executor correlation, and alert on writes with no decision ID.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A dashboard reports policy-engine uptime but misses unmediated payment calls.
Evidence to retain
Keep aggregated verdicts, correlation gaps, policy epoch and safely sampled traces.
04 / Canonical scope
Why this reference stands alone
Authorization latency owns timing; this page owns verdict distribution and coverage.
Illustrative implementation artifact
Coverage signals
rate(ALLOW, actionClass, policyVersion)
rate(DENY, reasonCode, policyVersion)
count(executorWrites without decisionId)
count(ALLOW without executor receipt)
count(executor UNKNOWN without reconciliation)Primary references