Decisions and approvals

A real authorization request creates one decision. It records the agent, action, evaluated context, policy and version evidence, matched rules, resolution, timestamps, and state changes.

An allowed action may continue immediately. A blocked action must stop. An action requiring approval enters a pending state until an authorized person approves or rejects it.

Approval is not execution. After approval, a supported trusted host claims and dispatches the intended call. It then reports whether the external operation completed, failed, or has an unknown outcome. An unknown outcome must be reconciled before retrying because repeating a non-idempotent external call could duplicate the side effect.