Reference

decision

What was actually approved. Plain text, e.g. "Approved use of Vendor X's AI copywriting tool for marketing drafts." Not a category. The specific thing.

owner_name / owner_role

Who granted it, and in what capacity. A name without a role is an assertion. A name with a role is a fact someone can be held to.

authority_mode

Where authority actually sits for this system, across three positions: a human decides, AI recommends and a human approves each one, or AI decides outright. It has no default. Quietly assuming the safest sounding answer would manufacture a position nobody took, so a record that never states this is marked incomplete rather than passing silently.

grant_type / credential_reference

An API key or agent credential is the same kind of standing authority as a decision, so it gets the same record. The reference names which credential, a key name or the last four characters. Never the secret itself, and the field refuses anything long enough to be one.

decision_date

When authority was granted. Fixed at creation, sealed, not editable afterwards.

expires_at

The shelf life. Required, not optional: an authorization with no expiry is not a strong grant, it's one nobody was ever forced to think about ending.

expiry_conditions

The specific, observable conditions that void the grant early, written at the moment of signing, not added afterwards. "Vendor X appears on a regulator's enforcement list" is a condition. "If things go wrong" is not. Each one carries its own action: anyone who can view the record, not just the owner, can mark it observed the moment it becomes true. That pulls the expiry forward, never back, and seals as its own dated event. Where a condition is something a system itself can detect, like a linked credential's live scope drifting from what was sealed, the record pulls its own expiry forward automatically, no human has to notice first. At renewal, at least one condition must be genuinely reconsidered rather than retyped unchanged from the record it replaces — confirming what was already there proves you typed it, not that you chose it.

completion_condition

Optional, and answers a different question to expiry_conditions above. Those name how a grant dies. This names what it looks like to actually succeed, one plain statement of what completion is, written at signing rather than decided in hindsight once something has already happened.

graduation_condition / graduation_owner_name / graduation_owner_role

Optional, and a third question distinct from both expiry_conditions and completion_condition. A pilot is approved as small, reversible, and time boxed. It can outgrow all three quietly, a second team starts relying on it, a process gets redesigned around it, with no single step ever looking unreasonable. This names the usage, dependency, or elapsed time that converts it from a pilot into something needing a fresh, properly scoped decision, and who is obliged to notice when that happens. Marking it observed never voids the grant, it puts a dated fact on record.

stop_authority_name / stop_authority_role

Optional. Who has standing to halt this before its natural expiry without asking permission from whoever depends on the timeline — distinct from the owner, who approved it, and often nobody distinct exists to name, which is an honest empty field, not a gap being papered over.

defend_authority_name / defend_authority_role

Optional. Who is obligated to justify this decision to a regulator, board, or court if it's disputed, a separate duty from approving it or being able to stop it.

escalation_ceiling

Optional, one statement of where the buck stops in a dispute. Distinct from the delegation chain, which shows who delegated to whom, not where it ultimately ends.

named_by_name / named_by_role

Optional. owner_name above is who holds the seat, this is who put them in it — a distinction that matters because a seat that assigns its own accountability is just marking its own homework. For a solo founder or small business there's often no one above the owner to name, and leaving this blank, or writing "self assigned," is the honest answer, not a gap.

owner_confirmed_name / owner_confirmed_at / owner_confirmed_role

Optional. A seat named in a record nobody circulated is not accountability, it is a document produced later at a worse moment. This is the named owner's own confirmation, via a link only they can act on, that they actually know they hold it, and in what capacity — separate from the account holder asserting owner_name on their behalf.

owner_reconfirmed_name / owner_reconfirmed_at / owner_reconfirmed_role

Optional. owner_confirmed_at only ever answers whether the named owner once knew they held the seat, roles change, and nothing re-checked whether they still do. This is a second, later, distinct confirmation the account holder can request at any point, recorded separately from the original so both facts stay on the record rather than one overwriting the other.

external_dependencies

Optional. What this decision actually depends on outside the account, a vendor, a model provider, a jurisdiction, and whether losing that dependency has a tested fallback rather than an assumed one. Ownership tells you the switch could be taken away. This asks whether anyone has rehearsed the day it is.

warnings_overridden

Optional, and a different fact from risks_accepted above. That is the owner's own stated risk, accepted knowingly. This is a warning raised by someone else and overridden anyway, with a required reason. A clean risks_accepted list and a buried dissent look identical from outside unless the dissent has its own field.

continuity_owner_name / continuity_owner_role

Distinct from the owner above. This is whoever holds the duty to renew the authorization or arrange a successor before it lapses. Added after a sharp public question: a lapse record used to fix only when a mandate went vacant, never who was accountable for it going vacant. This field closes that gap.

required_by_name / required_by_organisation

Optional, and left blank on most records, honestly. Every boundary authorization record is self authored, the account holder writes their own limits. A boundary you write for yourself and a boundary someone else is holding you to read very differently, even worded identically, because one was a choice you could have skipped and the other is a condition. This field names who, if anyone outside, actually required this boundary to exist, a lender, an insurer, a board resolution. Blank means self imposed, a real limit, but a volunteered one.

supersedes_id

If this record replaces an earlier one, because the role holder changed, this links to the record it replaces. The chain of custody for the mandate is provable, not left as separate, disconnected records.

options_considered / risks_accepted / evidence

What else was weighed, what risk was knowingly taken and how it was mitigated, and what evidence the decision actually rested on. The difference between a decision and a guess, on the record.

reasoning_recorded

Computed once, at signing, from whether any of the three fields above held anything at that moment. Never recomputed later, so it can't be made true by editing the record afterwards. A name and a date attached to a decision is not the same fact as reasoning behind it, and an empty field used to render as nothing at all, no different on screen from a record that simply chose not to show this section. Now it's a stated fact either way: recorded, or not recorded, never silent.

affected_parties

Optional, and a different fact from risks_accepted and warnings_overridden above. Those describe risk to the business making the decision. This describes who is downstream of it and what it costs them, the person whose timeline doesn't match the one the business reports on. Self reported, not independently confirmed, because the point is giving it somewhere to exist at all.

impact_disclosed

Computed once, at signing, from whether affected_parties held anything at that moment. Same treatment as reasoning_recorded. Most records will read as not disclosed, honestly, because most decisions never had anyone downstream named. That is the finding this field exists to make visible, not a defect in the field.

Try to break it

Seal the sample record below, then edit anything, one character is enough, and watch the fingerprint stop matching. This runs entirely in your browser. Nothing here is sent anywhere or stored.