Deep dive · the decision path
How an action gets admitted
Every agentic action is decided before it runs. It passes through six ordered gates against present state, ends in one of three verdicts, and leaves a signed record either way. This is the path in full, the reference companion to the live decision player.
The six gates
In order. Each asks one question against present state. The first gate that does not pass stops the action, so a decision names the exact reason it was refused, not a generic decline.
Authenticity genuine and unaltered?
The action arrives signed by the agent's registered key, bound to the exact operation. The signature covers the fields, so a request cannot be edited in transit.
Refused when the signer is unknown, the signature does not verify, the envelope was replayed, or its window has expired. Nothing downstream runs on an unauthenticated request.
Standing actor active and entitled?
A valid signature proves who is acting. Standing asks whether that actor is allowed to act right now: the agent must be active and entitled to this specific operation.
Refused when the agent is revoked or is not entitled to the operation, even with a perfect signature.
Policy within the rules?
The compiled policy is evaluated over the signed fields: which operations are permitted, for which tenants, under which limits, to which destinations. Read actions are held to where their result may go.
Refused when the operation is outside policy, over a ceiling, or names a destination that was never declared.
Entity match the right account?
The target is resolved across the authorities the company already runs, returning a match with a confidence score. Authorities are treated as peers; disagreement is a signal, not something to average away.
Refused when the reference resolves to another tenant or the authorities disagree. A genuinely ambiguous match is escalated to a person rather than guessed.
Freshness still valid vs live state?
An approval granted a minute ago is recomputed against live state at decision time, never trusted from a cache. The action is admitted only if the state it depends on still holds.
Refused when a dependency the action rode on has moved. The specific dependency that changed is named on the record.
Limits within the mandate?
The agent acts under a human's delegated authority: which merchants, which categories, per-action and cumulative amounts, how many actions. Split transactions are accumulated against the running total.
Refused when the action exceeds the mandate. It can clear every conventional check and still stop here, because it exceeds what the human actually authorized.
Three verdicts
The default is an automated verdict. A person is asked only when confidence is genuinely low, so oversight stays real instead of becoming a rubber stamp under load.
All six gates clear. The action proceeds, and a signed record is emitted as its evidence.
The first gate that fails stops the action before it runs. The reason is written on the record.
Uncertainty, most often a low-confidence entity match, hands the decision to a person rather than guessing.
Reversible and irreversible
The same six gates run for every action. What differs is how the fifth gate confirms, and what happens when the authority cannot be reached.
Reversible
Decided at the edge
A reversible action decides next to where it happens, against present state. A revocation that has reached the edge is enforced there.
Irreversible
Confirmed at the authority
An action you cannot take back confirms synchronously against the authoritative hub. Under a partition it fails closed rather than trust a stale cache, and a fail-closed action does not consume the agent's counter, so a legitimate retry still succeeds once the authority returns.
The signed record
Evidence before the fact
Every decision, allow and deny alike, emits a FederatedIQ-signed, hash-chain-anchored record, produced at decision time and verifiable by anyone holding the public key, trusting neither the actor nor the point that enforced it. It is evidence created before the action, not a story reconstructed from logs after.