Verify observed outcomes

An independent read of authoritative state distinguishes a tool response from a completed effect.

01 / The operating case

What changes in a real workflow?

A firewall API acknowledges a rule but devices have not applied it.

Trace the authority boundary
  1. 01Authority origin
  2. 02Task and grant
  3. 03Current decision
  4. 04Observed outcome

02 / Decision contract

What the executor must check

After a bounded propagation interval, query authoritative effective configuration, correlate target and version, and report confirmed, partial or unknown.

InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome

03 / Failure and evidence

What goes wrong, and what can be proven?

Failure mode

A transport 200 is treated as proof of deployed protection.

Evidence to retain

Retain observation source, timestamp, state hash and discrepancy from intended effect.

04 / Canonical scope

Why this reference stands alone

Execution receipts record what the executor attempted; this guide verifies resulting state.

Illustrative implementation artifact

Outcome reconciliation table

decision ALLOW + executor COMMITTED + state changed = CONFIRMED
decision ALLOW + executor UNKNOWN + state changed = CONFIRMED
executor COMMITTED + old state = PARTIAL_OR_DELAYED
no authoritative read = UNKNOWN

Primary references

Read the underlying material

Architecture discussion

Choose one consequential action and make its boundary explicit.

Request a Conversation