01 / The operating case
What changes in a real workflow?
A payment DENY is investigated after policy has changed twice.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Assign immutable policy version and digest, activate atomically, preserve prior bundles and put version in every decision receipt.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A mutable policy file makes historical ALLOW appear inconsistent or inexplicable.
Evidence to retain
Retain publication, activation, rollback and decision-version linkage.
04 / Canonical scope
Why this reference stands alone
Policy rollout governs staging and release; this page owns version identity.
Illustrative implementation artifact
Immutable policy record
{policyVersion, contentDigest, publishedAt,
activatedAt, signer, predecessorVersion}
decisionReceipt.policyVersion = activeVersion
rollback activates prior immutable digestPrimary references