Assurance
How we try to find out we are wrong before you do, and what each method is actually worth.
A model of the gate
Deny-first is the property everything else rests on, so it is modelled formally rather than only exercised by tests. Two checks are runnable: an agreement report comparing the model against the decisions the real gate produced, and an exhaustive exploration of interleavings, which is the concurrency property no finite test suite covers.
No un-gated way to move money
A structural check scans for value-moving call sites and asserts that every one of them sits behind the decision or the operator path, and that no package re-exports a raw settle. It is a heuristic and a regression gate rather than a proof, which is the honest description of what it can catch.
Keeping the surfaces honest
- The protocol is described as data, and the REST, SDK, tool and command-line surfaces are projected from it. A surface that disagrees is a generator bug, not a local decision.
- A drift gate watches the event surface, so an event cannot quietly change shape.
- A conformance harness lets a foreign verifier prove itself against committed vectors captured from the real code.
Rehearsing a change
Granting or tightening a mandate is otherwise a live act with no rehearsal. Because the record carries every input each past decision consumed, those inputs can be run forward under a candidate policy: what would this change have done last month, asked before doing it for real.
The engine is pure. It never writes to the record, never settles, and never mutates anything persisted.
Evaluating behaviour
An evaluation layer grades the gate's signed decision by replaying the enforcement record, rather than by asking the system how it thinks it did. Adversarial cases are included, because the interesting failures are the ones that look like successes.
The end-to-end scenario
A machine actor with a hardware identity and a version-bound mandate finds a supplier, negotiates inside its authority, pays, takes delivery, books the cost against its own accounts, and proves the spend was covered by authority. Then it is refused several things it is not allowed to do.
It is a test first and a demonstration second. A narration that can drift from the code is not evidence of anything.