The run woke up under new rules

The run had been approved on Friday. On Monday, it was no longer allowed to finish.

N17Q had prepared a report, passed review, and waited for a scheduled delivery window. Over the weekend, the destination lost eligibility for the document's data class. The approval receipt was genuine. The consequence had not happened. Executing it under the old decision would have turned history into authority.

That weekend test changed how I treated every stored allow: it could explain the past, but it could not authorize the next action.

Policy decisions were observations at a revision

The first gate returned allow or deny and the workflow stored the boolean. That made the answer look timeless.

N17Q instead recorded policy revision, input digest, decision, reason class, applicable obligations, and evaluation time. The record explained a past transition. It did not grant perpetual capability.

Prepared artifacts and plans could cite the decision that shaped them. Future invocation evaluated current state again.

Policy history remained evidence without becoming a reusable pass.

Execution was the last local choice

Many checks happened during planning and approval because that was when issues were easiest to fix. The decisive check happened immediately before a consequential adapter crossed the local boundary.

N17Q reevaluated requester, delegation, data class, normalized consequence, connection, approval, budgets, prior effects, target revision, and policy. If any material fact changed, invocation stopped.

The gap between allow and action became explicit and intentionally short. Queueing, scheduling, and human delay could not smuggle an old decision past current rules.

Authority was current at the point where the product could still decline.

Policy revision was not the only change

The policy text could remain identical while its inputs changed. A document acquired a sensitive classification. A destination became external. A user role expired. A connection lost a required permission. The target resource moved.

N17Q used a versioned evaluation input manifest rather than checking only a global policy number. Material state references and digests travelled with the candidate and approval.

The final gate compared and reevaluated. A cache could accelerate identical inputs; it could not generalize from a similar-looking run.

Current authority depended on relationships, not one version counter.

A rule change in a central store was useless if workers kept a long cache or an offline queue continued dispatching.

N17Q distributed policy revision and revocation events into the run scheduler. Affected pending intents moved to reevaluation. Workers checked a freshness lease before invocation. High-impact connections could require an online decision at the boundary.

If the policy service was unavailable, the contract determined whether a narrow safe operation could proceed. Consequential external effects failed closed.

Revocation was an operational system, not merely a database edit.

Active runs were indexed by material scope

When a destination became ineligible, scanning every historical and active task was expensive and noisy.

N17Q indexed pending candidates and effect intents by requester, data class, connection, destination scope, capability, and policy obligations. A change event could find potentially affected work and mark it for reevaluation.

The index was conservative. False positives caused another check; false negatives could permit stale authority. Completed effects remained history and were not undone by marking their original decision invalid.

Policy changes became targeted state transitions instead of an emergency global stop.

Prepared work survived denial

Stopping execution did not require deleting the report or discarding the plan. The artifact could remain useful under a safer destination, later policy, or local handoff.

N17Q preserved the immutable candidate, prior approval, test evidence, and current blocker. It removed the unavailable delivery capability and offered eligible alternatives. Sensitive artifacts stayed under their storage and retention policy.

The final account distinguished work completed locally from consequence not performed.

Revocation constrained the future without pretending the past had not produced anything.

The reviewer had approved exact bytes and destination under Friday's state. That consent was necessary and no longer sufficient.

The receipt included policy revision and material inputs so the final gate could detect drift. A new policy allow might still require fresh approval if the destination, residual risk, or recovery contract changed. A policy denial always blocked execution regardless of an older receipt.

This ordering kept human and product authority complementary. Consent did not become an exception token.

The interface explained whether review, policy, or both needed resolution.

Grandfathering had to be explicit

Some policy changes legitimately allowed already-started operations to finish. Others applied immediately. Assuming either behavior globally was dangerous.

N17Q policy rules declared effective time, applicable state transitions, and whether any grandfather condition existed. A grandfather grant was a current rule with a bounded predicate, not reliance on the old decision.

The final gate recorded which provision applied. User interfaces avoided vague phrases such as “previously approved.”

Exceptions became reviewable policy semantics rather than folklore around deployment timing.

In-flight attempts were different

If a request had already been sent when policy changed, the system could not truthfully claim it stopped the effect. Cancellation or compensation depended on the adapter contract.

N17Q marked the attempt boundary, prevented new attempts, and entered reconciliation. The new policy could restrict recovery capabilities, but the effect ledger still had to determine world state. Operators received a handoff with current authority and prior action separated.

Revocation controlled the next available choice. It did not travel backward through the network.

Timing determined whether a policy change prevented, contained, or merely documented impact.

Local reads could be revoked too

Policy was not only about external effects. A run could retain access to a mounted source after the user's role changed or the source's classification increased.

N17Q applied short-lived capability leases to sensitive reads. Checkpoint context retained safe derived observations according to policy, while future file or database access required current eligibility. Revocation could remove a mount or encryption key from the environment.

The product declared what already observed data could remain in context or artifacts. Some changes required quarantining or terminating the run.

Current access and historical knowledge were related but not identical problems.

A compacted summary might say “approved for delivery” long after the receipt or policy had expired. A model could reasonably act on the sentence if tools remained available.

N17Q compiled current capability state from the policy engine and durable records. The summary labeled historical decisions and unresolved changes. Execution gates ignored prose for authority.

After revocation, the destination tool disappeared or returned a typed current denial. Switching models or reconstructing context did not restore it.

State outlived language without being ruled by language.

Scheduled actions needed reevaluation by design

A task queued for next week had a larger authority gap than an immediate action. Treating scheduling as delayed execution of an already authorized request made policy stale by default.

N17Q stored a prepared intent and schedule, then required eligibility at wake time. Time-sensitive approvals could expire earlier. Source and artifact preconditions were rechecked.

The scheduler reserved no permanent connection authority. It woke the workflow into a new decision boundary.

“Scheduled” meant when to reconsider execution, not a promise that execution would occur.

Policy caches were scoped and short-lived

Evaluating every safe local operation remotely could make the system fragile. Caching every allow could make revocation slow.

N17Q assigned cacheability and freshness requirements per capability and impact. Pure fixture reads could use a run-scoped policy snapshot. Sensitive disclosure required current evaluation. Revocation events invalidated matching cache entries.

Every decision named whether it used cached policy and the maximum staleness. Evaluation failure remained visible.

Performance optimization became part of the policy contract rather than an invisible layer around it.

Rule rollout used shadow evaluation

A new rule could unexpectedly stop many benign runs. Shipping it directly without observing impact encouraged emergency bypasses.

N17Q evaluated candidate policy revisions against historical sealed traces and current pending intents in shadow mode. The analysis could reveal which actions would change verdict, what evidence was missing, and which workflows lacked an alternative.

Shadow results did not authorize or deny live actions. They informed rollout, migration, and communication. Urgent revocations could still apply immediately.

Policy engineering benefited from the same replay discipline as agent behavior.

Running today's rules against Friday's trace could show that the old action would now be denied. That was retrospective analysis, not proof that Friday's system had ignored its own policy.

N17Q kept original and retrospective verdicts with their revisions and purposes. Incident reports could compare them. Metrics did not silently relabel old valid runs as invalid or hide newly recognized risk.

If a past effect required remediation, that became a new workflow under current authority.

Better rules added understanding without falsifying chronology.

Policy changes could invalidate verification

A report might have passed content checks under an earlier redaction rule. A new rule could require removal of an additional field before delivery.

N17Q obligations were part of candidate materialization. Changing a content obligation marked the artifact and affected verification stale. The agent prepared a descendant candidate, reran relevant checks, and requested approval for the new bytes.

The system did not merely reevaluate the old artifact and call it compliant if the required transformation had never occurred.

Policy could change the work product, not just the gate.

The UI showed changed facts

“Policy denied” was frustrating when a user had already approved the action. N17Q compared the earlier reviewed state with current evaluation and rendered the material difference.

For the scheduled report, it showed that the destination's eligibility changed after approval, no delivery attempt had started, the artifact remained preserved, and two safer alternatives were available. It did not expose protected rule internals.

The old approval stayed visible as historical evidence and was clearly inactive.

A specific explanation made the stop feel like accountable state rather than arbitrary reversal.

After a revocation, several queued workers could wake, receive denial, and reschedule. Without shared state, they created a denial storm.

N17Q moved the intent to a durable policy-blocked state and released execution leases. Only a relevant policy, input, or user event could make it eligible for reevaluation. Monitoring remained passive.

Budgets counted the attempts already spent and preserved a small reserve for resolution. Models were not repeatedly invoked to rediscover the same no.

Stopping old work cleanly was a scheduler property as much as a policy rule.

Emergency global stops remained narrow

An incident might require disabling a connection or capability across all runs immediately. A broad kill switch could also interrupt unrelated safe work and destroy evidence.

N17Q supported scoped revocation by connection, effect class, destination, data class, or tool mapping. The scheduler checkpointed affected runs and sealed workspaces. In-flight attempts entered contract-specific reconciliation.

The event and rationale were durable. Restoring service required a new policy state; it did not auto-resume every old intent.

Emergency control gained precision by sharing the same state model as ordinary policy.

Most tests fixed policy for an entire run. N17Q fixtures changed roles, classifications, connections, and rules between preparation and execution.

Invariants asserted no adapter invocation under current denial, preservation of prior evidence, correct rematerialization after obligations changed, and honest final claims. Counterfactual scenarios applied a grandfather rule or restored eligibility.

The agent was graded on adaptation. The product was graded on enforcement and explanation. The simulated world showed whether containment held.

Long-running safety became a trajectory property rather than a startup check.

Notification did not become pressure to override

When a policy change blocked a nearly finished run, the obvious interface temptation was a prominent Continue anyway control. That converted frustration into an exception path whose semantics few people could evaluate.

N17Q notified the task owner with the changed fact, affected consequence, preserved artifact, and eligible resolution paths. If policy supported an exception, it was a separate scoped workflow with required authority, rationale, expiry, and audit. Most denials had no such path.

The system optimized for a clear next decision rather than quick restoration of momentum.

Policy remained a boundary even when timing made the boundary inconvenient.

Derived artifacts retained policy lineage

A report generated from sensitive source material could remain sensitive after the source mount was revoked. Removing access did not automatically make derived text eligible for broader use.

N17Q attached data lineage and classification obligations to artifacts. Policy reevaluation considered those references and any approved transformations such as redaction or aggregation. If lineage evidence was incomplete, the artifact could not be treated as clean by omission.

Changing source policy could quarantine pending derivatives and mark their approvals inactive. Safe local retention followed its own rule.

The run remembered not only what it had read, but what its outputs depended on.

Policy migration included user-facing work

A technically correct rule change could strand hundreds of prepared tasks without explaining what owners should do. That operational burden encouraged manual workarounds.

Before non-emergency rollout, N17Q's shadow analysis grouped affected intents by available alternative: rematerialize with new redaction, choose eligible destination, request a different role, export locally, or stop. Product copy and migration tooling were reviewed with the rule.

Affected runs received structured state transitions rather than generic errors. Metrics tracked unresolved backlog and exception requests.

Policy maintenance included the experience of work that had already begun.

Suppose the destination regained eligibility on T04P. Automatically continuing the Friday schedule would surprise the owner and might use an artifact whose relevance had expired.

N17Q required an explicit resume event. It refreshed target state, source freshness, candidate bytes, verification, recovery contract, and approval eligibility. The old policy-blocked interval remained visible. If everything still matched, the workflow could reactivate the same unexecuted semantic intent; otherwise it created a descendant candidate.

Restored capability reopened a decision. It did not replay a missed command.

This kept policy recovery from turning into delayed, unattended consequence.

Policy evaluation had an evidence budget

Some rules depended on directory membership, destination metadata, data scanning, or remote connection status. Gathering all inputs at every safe read would be expensive; skipping them at execution would be unsafe.

N17Q declared evidence dependencies and freshness per decision point. Planning used cached or partial information to identify likely paths. Materialization gathered precise facts. The final gate required the strongest current set. Missing critical evidence produced indeterminate and stopped.

The trace distinguished policy denial from inability to evaluate policy. Operators could repair the evidence source without weakening the rule.

Current authority was only as trustworthy as the inputs used to establish it.

Monday's run stopped before delivery

At wake time, N17Q refreshed the scheduled intent. The destination no longer satisfied the document's classification rule. The final gate denied invocation, invalidated the delivery receipt, and preserved the approved report.

The agent offered a local export and a narrower eligible destination. It did not try a different messaging tool or claim the scheduled action had failed. The final account said no external effect had begun.

When policy later changed again, the old intent remained blocked until deliberately resumed and reevaluated. Nothing executed merely because the scheduler found it waiting.

That pause became part of the task's final chronology. The report named the original allow, the intervening revocation, the absence of any adapter attempt, and the later resolution choice. Reviewers could see that enforcement had changed prospectively without being told the earlier approval was fake or the artifact had disappeared.

A policy decision explains why a transition was allowed at one moment. It is not a property permanently attached to a run.

Durable agents need durable memory of past authority and a live relationship with present authority. Keep both, and an old run can stop without losing its work or lying about its history.

That is how enforcement remains current while the archive remains true.

Neither has to be sacrificed for the other.

Even across long pauses.

Reliably.