Authority, Containment, and Decision Replay Lab

1. Scenario and safety

Use synthetic repositories, identities, credentials, providers, and data. The workflow has permission to create a reversible synthetic change and publish to a local mock endpoint. It cannot access real production systems or notify real people. A designated operator and independent reviewer are present.

2. Objectives

• map human, service, workload, agent, capability, and tool authority;
• exercise pause, cancel, revoke, and quarantine as distinct controls;
• survive a failed primary orchestrator and duplicate emergency commands;
• reconcile an unknown external result;
• replay the decision from retained observable records; and
• restore authority through independent verification and named approval.

3. Setup manifest

Record system and workflow version, identities, policy, grants, capability versions, context package, quality contract, budgets, emergency owners, mock-provider idempotency window, expected state transitions, cleanup, and evidence locations. Create one expiring grant and a backup incident-control identity that does not depend on the primary orchestrator.

4. Procedure and failure injections

1. Run the baseline to accepted synthetic outcome. Retain the complete authority and evidence chain.
2. Start a candidate run and inject a loop that exceeds the planned tool-call rate while a mock publication returns a timeout after applying its effect.
3. Make the primary orchestrator unavailable.
4. From the independent control path, pause the workflow and revoke the attempt grant. Send the same commands twice.
5. Verify the worker cannot schedule new steps or call the tool gateway. Do not treat acknowledgement as enforcement.
6. Quarantine the implicated capability version and identify all affected queued/running work and evidence.
7. Reconcile the mock publication using its idempotency key. Classify the effect as completed, absent, or unknown; compensate if the manifest requires.
8. Reconstruct the decision chain from intent, policy, grant, manifest, attempt, tool receipt, control events, and human decisions.
9. Recover with a qualified capability version, a new manifest and grant, independent checks, and named restoration approval.
10. Verify cleanup: leases expired, grants revoked, queues reconciled, sandboxes removed, mock effects disposed, evidence retained by policy.

5. Required evidence bundle

• system record, scenario manifest, identity and delegation graph;
• policy decisions and exact grants with expiry/revocation;
• ordered workflow, attempt, tool, and control events;
• duplicate-command deduplication and enforcement verification;
• mock-provider receipt and reconciliation decision;
• capability quarantine and blast-radius result;
• evaluator results, proof package, human containment/restoration decisions;
• costs for baseline, failed run, containment, and recovery; and
• cleanup receipts, retained gaps, and reviewer sign-off.

6. Scoring rubric

7. Retained gaps

Record timing uncertainty, unavailable signals, untested failure domains, and any manual step. A lab specification or one successful run is not production proof; retain exact versions and repeat under the target risk and topology.