Writing
#Decision records
10 pieces with this tag.
Agents are principals: machine identity as a first-class actor
Every identity source hard-coded the principal type to user, so a caller no human authenticated was recorded as human. Found while building, not by review. Decision record ten.
Adopting a vendor agent harness with its dangerous defaults enforced off
A vendor harness reached stable. Four of its default capabilities each break a platform rule. Adopt it, and enforce all four off at two fail-closed points. Decision record nine.
Graduated autonomy: delegate by blast radius, keep binding decisions human
Four autonomy classes for a build pipeline that produced decisions faster than a human could ratify them, and the one class that stayed human-only. Decision record five.
Break-glass: deny-all by default, and a designed narrow override
When the approval service is down, the override you did not design is the one that gets invented under pressure. The five properties of the one I did. Decision record eight.
Content entering the model is untrusted at every entry point
Actions leaving the model were well governed. Content entering it was not. Six entry points, one named kernel control each, and three honest limits. Decision record six.
The controls an extension can never disable
A fixed set of kernel controls no extension can replace, and the retrieval filter that was wrongly listed as replaceable. Decision record three.
A library the governed code can decline to call is not a control
An in-process governance library can be a useful signal source. It cannot be an enforcement point, because nothing forces the call. Decision record four.
Model output is an untrusted candidate until promoted
Every model output starts untrusted and becomes a response, record or memory only through an explicit promotion path. Memory as the worked example. Decision record two.
Business rules are enforced outside the model
Prompts configure behaviour; they do not enforce policy. Why executable rules live in a policy service outside the model, and what that costs. Decision record one.
Three release gates, and only a human releases
Deterministic checks may block. Statistical evaluation may block, or say inconclusive. Only a named human releases. Why a judge model never gates. Decision record seven.