Authority, Autonomy, and Emergency Control
Define how authority is delegated, exercised, reduced, revoked, contained, and restored.
A focused view of boundaries, contracts, state, authority, failure paths, and tradeoffs drawn from this chapter.
4. Command and event contracts
Every emergency command includes command ID, subject selector, requested
action, actor identity, delegated role, reason, severity, expected version,
idempotency key, issued time, deadline, and notification policy. The control
plane records acceptance or rejection before dispatch. Components emit
control.requested, control.acknowledged, control.enforced,
control.failed, and control.verified events with one correlation key.
Acknowledgement is not enforcement. Enforcement is not verified safety. Verification checks scheduling, running work, credentials, queues, network access, side effects, artifacts, and downstream systems.
5. Control sequence
- Detect or receive a credible report.
- Resolve subject and blast radius from inventory and live state.
- Authorize the narrowest sufficient emergency action.
- Record the command durably before dispatch where possible.
- Fan out through independent control paths to scheduler, orchestrator, tool gateway, credential broker, and deployment system.
- Preserve attempts, events, artifacts, and relevant volatile state.
- Reconcile acknowledgement with observed enforcement.
- Escalate on timeout; use a broader control only when justified.
- Diagnose and choose compensate, rollback, failover, retire, or repair.
- Independently verify recovery before restoring authority.
7. Failure and recovery matrix
| Failure | Required behavior | Evidence |
|---|---|---|
| Orchestrator unavailable | Independent scheduler/gateway control path denies new effects | Gateway denials and queue freeze |
| Worker ignores pause | Lease expires; gateway denies tool calls; worker isolated | Lease, identity, and network events |
| Duplicate cancel command | Idempotent terminal result; no duplicate compensation | Command deduplication record |
| Revocation cache stale | Critical tools fail closed after bounded cache TTL | Cache version and denial test |
| Partial external side effect | Record uncertainty, stop retry, reconcile with provider | Provider idempotency key and reconciliation result |
| Control operator unavailable | Delegated backup assumes authority under policy | On-call transfer and signed decision |
| Recovery uses changed context | Resume denied; create new manifest or explicit replan | Context/version comparison |
9. Human override and dual control
Every high-impact action has a named override point and accountable owner. Dual control applies when one compromised or mistaken identity could create an irreversible or privileged effect. Emergency containment may use a single delegated incident authority when delay is more dangerous, but restoration of broad authority requires the defined approval and independent verification.
Review this chapter.
Challenge a claim, boundary, missing failure mode, unclear term, or unsupported evidence statement.
- Claim
- Boundary
- Failure
- Evidence