Factory System Inventory, Classification, and Lifecycle
Maintain one accountability record for each material autonomous delivery system without copying its subordinate registries.
A focused view of boundaries, contracts, state, authority, failure paths, and tradeoffs drawn from this chapter.
4. State model and commands
| Command | Authorized decision owner | Required evidence | Invalid when |
|---|---|---|---|
| Approve | Business, engineering, security, and assurance owners by risk | Purpose, architecture, risk, tests, controls | Critical fields or owner acceptance missing |
| Activate | System owner plus release policy | Qualified version and current proof package | Review expired or dependency revoked |
| Restrict | Control owner or incident authority | Reason, reduced ceiling, affected scope | Requested ceiling is broader than current |
| Quarantine | Emergency authority | Incident or credible control failure | Never blocked by ordinary change windows |
| Deprecate | System and capability owners | Replacement or exit plan, notice | Active dependents have no disposition |
| Retire | System owner and operations | Traffic stopped, grants revoked, records retained | Active work or unresolved downstream effect exists |
| Delete | Data owner | Retention satisfied, deletion receipt | Legal, incident, or audit hold exists |
Every command carries actor identity, expected record version, reason, idempotency key, policy decision, and resulting event. Compare-and-set updates prevent stale approval from overwriting a containment action.
6. Failure, recovery, and observability
| Failure | Detection | Containment | Recovery proof |
|---|---|---|---|
| Orphaned owner | Identity directory reconciliation | Block promotion and new grants | Accepted replacement owner |
| Stale registry reference | Version-resolution check | Freeze affected workflow | Re-resolved manifest and regression tests |
| Hidden downstream action | Egress and tool-call comparison | Quarantine capability and affected systems | Updated boundary map and side-effect test |
| Expired review | Due-date monitor | Restrict autonomy | Completed review with decision record |
| Deletion mismatch | Registry and storage reconciliation | Hold closure and notify data owner | Deletion receipts across all governed stores |
Emit state-change events with correlation identifiers. Measure inventory completeness, overdue review, unresolved owner, stale reference, exception age, time to containment, and time to verified retirement. Inventory data is classified and access-controlled; it often reveals sensitive architecture.
8. Tradeoffs and alternatives
A spreadsheet can start a small inventory but weakens referential integrity, event handling, and policy enforcement. A graph improves dependency and blast- radius analysis but does not replace authoritative registry ownership. Begin with one record API and explicit references; add graph projections only when measured review or incident needs justify them.
Review this chapter.
Challenge a claim, boundary, missing failure mode, unclear term, or unsupported evidence statement.
- Claim
- Boundary
- Failure
- Evidence