01 / The operating case
What changes in a real workflow?
A payment worker receives a decision for $8,400 but the queued payload now says $84,000.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Before commit, resolve immutable payee and amount, verify decision binding and expiry, perform atomic idempotency handling and reject mismatch.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A preflight ALLOW survives request mutation in the queue.
Evidence to retain
Store decision digest, committed payload hash, transaction ID and settlement state.
04 / Canonical scope
Why this reference stands alone
Gateway and wrapper checks may be bypassed; this page owns the final commit boundary.
Illustrative implementation artifact
Final commit invariant
assert decision.requestDigest == hash(commitPayload)
assert decision.targetId == resolvedTargetId
assert decision.notExpired and grant.current
assert idempotencyKey unique for business intent
COMMIT effect atomically with receiptPrimary references