The boundary an agent cannot argue with.
An instruction is advice, and an autonomous agent is exactly the reader that finds the edge of it. Where this system stops one, it stops it at the grant. Where it stops one only by instruction, that is written down as a residual rather than sold as a control.
Same core as the build system, put to the risk question. What is the blast radius of the worst thing the fleet can do unattended, what holds when nobody is watching it, and which parts of that are not finished yet.
Where the boundary is a grant, not a paragraph.
- Privilege, not policy
The application and its automated agents connect under a role with no superuser, no bypass of row-level security, and no ability to create roles. The approval ledger belongs to a different role entirely. An agent that decides to approve its own deploy finds it has nothing to write with.
- Blast radius is the sorting axis
Permission is sorted by what cannot be undone, not by how much work it is. A week of refactoring on a branch needs no permission. One grant against the production database needs a person, because git returns the first and nothing returns the second.
- Fail-closed by construction
A stage that fails, fails the run. A stage whose output cannot be read fails the run. A stage that could not execute is recorded as a skip carrying its reason, and its subject stays unproven in the record. The system's default answer is no.
- Absence is reported, never filled in
A missing credential, a missing store, a missing input: each yields an explicit unavailable with the reason attached. Nothing is inferred to keep a screen full. A value on a page traces to real data or it is not on the page.
- Probes read, they do not write
The checks that compare the system against its own store hold select rights and nothing more. Verification cannot mutate the thing it verifies.
- Overrides exist, and they sign their name
The gate and the contract check both carry named override switches. The contract check records the paths it was used on. The gate's own bypass records neither a reason nor a durable entry: it prints one line to the operator's terminal and proceeds. Enforcement the accountable operator cannot override is not a control, it is an outage waiting for the worst possible night.
The approval is closed to the thing being approved.
The last tier is enforced by the database. The role the application and its agents connect as holds no privilege of any kind on the approval ledger: it cannot read it, write it, or grant itself access to it. The ledger belongs to a separate role whose credential lives in an operator's own shell.
Recording an approval lands or fails loudly. There is no fallback connection and no queue that drains later. Both of those turn a missing approval into an approval that arrives eventually, which is the same thing as not having one.
An agent that decides to approve its own deploy discovers it has nothing to write with. Not a refusal it can reason around. No grant.
Four places this is not finished.
Each of these is written into the artifact that creates the control, in that artifact's own words, at the moment it is created. This page is quoting the system rather than confessing on its behalf. An entry leaves the list when the residual is closed and probed, and on no other occasion.
- Ledger role separation
Not finished Provisioned on a managed database whose role model may leave the application role holding an inherited administrative option over the approver role. Until that is probed directly, an escalation path may remain open.
- Ledger separation in effect
Not finished The separation binds only once the agents connect as the restricted role. Under an operator credential the ledger write still succeeds. That is not a theory: it is what the migration's own negative test recorded when it was written.
- Where the gate stands
Not finished The gate rules at commit and at push. It does not rule at the moment a file changes, so a working tree can hold work no verifier has yet seen.
- Reach of the contract check
Not finished The check compares declared scope against tracked files. A path the repository does not track is reconciled by a recorded acknowledgement rather than by the check itself.
A vendor whose control list has no residuals column has one of two things: a system nobody has probed, or a page that dropped the column. Ask which.
Patent pending, U.S. and international.