One last check before execution

The N17Q action was allowed when the agent planned it and forbidden when the worker was ready to execute it.

Between those moments, the target repository advanced, the approval expired, and the simulated destination changed its visibility. The queue still carried an allowed: true field calculated several minutes earlier.

The worker trusted it.

Policy at planning time explains whether a proposal is worth pursuing. Authority must be checked again immediately before consequence.

Planning and execution lived on different clocks

An agent could propose a tool, wait for normalization, request approval, sit behind other work, survive a process restart, and execute later. Each stage introduced time for state to change.

The first design treated policy as part of plan compilation. Once the call entered the queue, it looked like ordinary work.

I replaced the Boolean with a policy-decision record and an execution requirement. Historical allow remained evidence. It never became a timeless capability.

The worker asked the current world again.

Planning often began with aliases, relative paths, or a high-level goal. Execution needed canonical resources, exact bytes, destination, and effect identity.

N17Q normalized first, prepared immutable artifacts where possible, and ran final policy over that representation. Unknown fields, changed defaults, ambiguous paths, and stale handles failed before the gate.

Approval and policy referred to the same digest the adapter would send.

A general plan could be eligible while one concrete interpretation was not.

Identity was current, not copied

The queued job stored requester and delegation references. The worker re-established their current status through the authority service.

A removed workspace member, expired delegation, revoked service identity, or changed role stopped execution. The model's run continued to exist without preserving the former authority.

Credentials resolved only after this check and under the narrow adapter mapping. The queue payload contained no durable secret.

Long-running work did not turn a past login into permanent permission.

The approval receipt bound exact effect intent, normalized arguments, checkpoint, policy digest, world preconditions, reviewer, and expiry.

The final gate verified signature or integrity, consumption state, revocation, current requester, expiry using server time, and matching consequence. It then applied current policy, which could be stricter than when approval was issued.

A valid historical approval could therefore be non-executable. The trace preserved both facts.

Consent satisfied one condition; it did not freeze all others.

World preconditions needed authoritative reads

A patch required the same repository base digest. An export required the same artifact and allowed destination. A create action required no prior effect for the semantic intent.

The gate loaded these from authoritative local state or used adapter-supported conditional requests. Cached UI state and model memory were not enough.

Where a remote system supported version tokens or conditional mutation, the adapter sent them. Where it did not, N17Q narrowed claims and kept stronger recovery paths.

Checking immediately before execution reduced the race without pretending every distributed system offered atomic compare-and-set.

Local state changed atomically with intent activation

Within N17Q's database boundary, policy eligibility, approval consumption, effect-intent state, request identity, and outbox creation committed together.

Two workers could not both consume one receipt or start two local intents. If the transaction failed, no external attempt began. The adapter worker read only committed outbox work.

This did not make the remote effect part of the transaction. It made the local decision and durable intention coherent before crossing the boundary.

Z29C and receipts handled the uncertainty after that crossing.

External state still raced

Between a status query and a remote mutation, another actor could change the resource. The final local gate could not eliminate that interval.

N17Q preferred provider-side conditional requests, idempotency keys, and resource revision arguments. A conflict returned current evidence and stopped. An adapter without such support received a weaker contract and stricter approval or eligibility.

The interface explained residual risk rather than advertising a lock the product did not hold.

Immediately before was the best available point, not a claim of simultaneity across systems.

A server schema, adapter version, destination mapping, or effect contract might require review after the action was approved.

The queued intent pinned the mapping revision. The final gate verified it remained active and compatible. A meaning-bearing update paused old work for migration or new preparation.

It never sent approved product arguments through a newly interpreted remote schema because the friendly tool name stayed the same.

Connection lifecycle became part of execution authority.

Budgets were charged at the boundary

Planning could reserve estimated capacity. Actual execution consumed tool-call, effect, cost, time, and concurrency budgets transactionally.

Another branch might use the remaining effect allowance first. The later action then stopped or requested an explicit budget change. A reserved slot had expiry and release rules; it was not invisible permanent capacity.

Retries charged attempts separately while one semantic effect count remained. Status queries used their own budget class.

Cumulative limits stayed accurate under parallel runs because the gate saw current counters.

The run might learn after approval that an earlier unknown attempt had completed. Starting the queued create would duplicate the consequence.

The final gate queried the effect registry and simulated or authoritative world evidence. An existing receipt completed or reconciled the intent instead of invoking the adapter. An unresolved attempt forced the recovery path.

The model did not get to explain that another try was probably safe. The tool contract and evidence decided eligibility.

History participated in authorization.

Policy change was prospective, not revisionist

When a rule changed, N17Q did not rewrite the run's original configuration or mark old allowed actions forbidden after the fact.

It appended a policy-change observation. The next gate evaluated under the current version and linked both historical plan decision and execution decision.

Completed effects remained completed. Pending work could stop. Re-enabling later did not revive expired approval automatically.

The trace could explain when the rule changed and which consequence it prevented.

A stale precondition or new policy denial did not discard the patch, evidence, review notes, or artifact automatically.

N17Q moved the intent to a typed state with reason and safe next actions: rebase, prepare new approval, choose local preview, wait for reconciliation, request scope, or stop. The old approval lost power and remained evidence.

This made strict checks tolerable in long workflows. Safety did not require punishing the author with lost work.

Humane recovery supported enforcement rather than weakening it.

After denial, the next checkpoint included a reason useful for replanning: target changed, capability disabled, approval expired, destination no longer allowed, effect unresolved, or budget exhausted.

It did not expose hidden policy clauses, secret resources, credential details, or alternative forbidden destinations. The model could propose a narrower action or ask a person.

Equivalent repeated requests linked to the denial and could trigger stop policy.

Final-gate refusal became an observable planning input, not an invitation to negotiate authority.

Reads also passed the gate

It was tempting to reserve execution policy for mutations. Reads could expose sensitive data, consume cost, observe a changed resource, or cross a network boundary.

N17Q applied current scope, data policy, connection health, output budget, and task eligibility before reads. They rarely required human approval but still required authority.

Cached or replayed observations had their own fixture and freshness rules. A read-only name did not skip the boundary.

Least privilege included what the agent could learn.

Command proposal policy checked executable, arguments, path, network need, and scenario relevance. Immediately before process start, the sandbox verified current environment profile, remaining resources, workspace digest, working directory, and denied routes.

The policy service could allow test conceptually while the sandbox rejected a command whose repository script now resolved to a network downloader.

Both decisions entered the trace. The lower layer did not assume orchestration was bug-free.

Defense in depth preserved different knowledge at each boundary.

Early jobs serialized user roles, policy result, destination configuration, and credentials. They became stale and dangerous.

The corrected queue stored stable run, intent, artifact, mapping, and request references plus expected digests. Workers loaded current protected state and verified matches.

The payload could be replayed after a crash without carrying yesterday's permission. Tampering with a reference or digest failed normalization and authorization.

Durable work held identity; the gate supplied current authority.

Exactly one worker passed locally

Worker leases prevented concurrent processing and did not prove an effect had not already happened. N17Q combined lease with intent state, unique attempt identity, approval consumption, and outbox transaction.

If a lease expired during an unknown remote call, another worker did not start blindly. It inspected attempt and effect evidence according to the adapter contract.

The final policy gate ran for every new attempt, including recovery. A lease handoff did not transfer a stale allow.

Liveness coordination and authorization remained separate.

A run could schedule a retry after rate limit or wait until an approval window. The scheduler stored next eligible time and semantic intent.

When the time arrived, it enqueued evaluation, not guaranteed execution. Current membership, policy, budget, mapping, preconditions, and effects all ran again.

The UI said scheduled for recheck rather than scheduled to execute when conditions were not fixed.

Time passing never strengthened authority by itself.

A checkpoint summary might say “export approved” and omit the bound artifact, expiry, or changed destination. N17Q never parsed that sentence into permission.

Approval and policy records remained structured state referenced by checkpoint identity. Context compilation could tell the model that a review existed while the final gate loaded the authoritative receipt independently.

If compaction lost an unresolved constraint, evaluation failed the summary, but execution safety did not depend on model memory retaining it.

Natural-language continuity and authorization state followed different durability rules.

Handoffs did not transfer stale decisions

When one configured agent role handed the run to another, the receiving role inherited a bounded checkpoint and task state. It did not inherit a cached allowed result or the sender's tool set.

Every proposed capability entered current normalization and policy under the active role's delegation. Existing approval remained usable only when it bound the same intent and policy allowed the new executor path.

The handoff event made responsibility visible without turning orchestration into an authority multiplier.

Authorization sometimes depended on classifications or resource metadata retrieved from another service. Caching them indefinitely merely moved the stale decision earlier.

The policy contract named authoritative source, acceptable age, failure behavior, and whether stale data required denial or reduced scope. High-consequence execution preferred current strongly identified observations.

If the authority service was unavailable, N17Q failed closed for the effect while preserving manual and local work. Availability did not silently lower the bar.

The gate was only as current as the evidence it deliberately accepted.

A bug in normalization or rule ordering could allow an action despite running at the correct time. N17Q pinned policy engine and rule-set revisions, generated explainable decision evidence, and tested conflicts and default-deny behavior.

Unknown capability, missing classification, malformed context, and evaluator exception denied execution rather than falling through. Rule changes ran the mutation fixtures that altered world state after approval.

Putting policy last was necessary and not sufficient. The gate had to be a maintained product component rather than a ceremonial middleware call.

External providers could enforce another gate

Where possible, N17Q sent scoped credentials, conditional resource revisions, and idempotency identities so the receiving service could recheck authority and state too.

The remote system had information the local harness could not guarantee, such as destination ownership changed moments ago. A remote denial became a typed outcome and did not imply local policy had been pointless.

Two gates protected different sides of the boundary. Neither was assumed to make the other infallible.

After a denial, a person could choose to perform the action directly in another system. N17Q recorded a human-reported or observed world change when it affected continuation.

That intervention did not convert the denied agent request into allowed history or grant similar future effects. The next checkpoint named the new state and policy evaluated subsequent proposals normally.

Human ownership included acting outside the harness without making the harness claim it had authorized or executed the action.

An unsafe connection or tool mapping could be disabled centrally. Workers checked the current registry immediately before invocation and again inside the adapter where practical.

Pending intents paused. In-flight work followed cancellation and reconciliation rules. Historical traces retained the old mapping without enabling it.

Restoring service required reviewed configuration and did not revive unused old receipts automatically.

Operational response could stop consequence without rewriting history.

The gate returned a receipt of decision

Every final evaluation recorded normalized consequence digest, active policy, requester and delegation, approval result, resource preconditions, budget snapshot, mapping revision, decision, and safe reason.

Allowed decisions linked to the resulting attempt and effect receipt. Denied decisions linked to recovery or run stop. Sensitive details stayed protected.

This let evaluation distinguish model behavior from system containment. An unsafe proposal blocked at the gate was not an external-policy violation, though it remained an agent-quality signal.

The decision itself became inspectable product state.

Loading current authority and preconditions added latency to a path that often followed an already long model run. Caching the earlier allow was attractive for exactly that reason.

N17Q optimized the authoritative reads, co-located local policy state, and evaluated independent checks concurrently where safe. It did not reuse stale decisions for consequential work. The interface showed verifying permission as a real state rather than hiding it inside a spinner.

For bounded read-only operations, policy could define a short freshness window. That exception was explicit, versioned, and absent for state whose change could redirect an effect.

Fast authorization remained authorization, not omission.

Final denial was not wasted work

Planning and preparation before the gate could become obsolete. That cost was real. Moving every check later would waste more; pretending the world could not change would create unsafe effects.

N17Q used early advisory policy to avoid obviously ineligible work, immutable preparation to preserve useful artifacts, and the final gate for current authority. Metrics separated denials caused by normal concurrency from avoidable stale queues.

The feedback improved scheduling and review expiry without weakening the boundary.

Fixtures planned and approved an action, then changed target revision, user role, policy, approval expiry, destination scope, tool schema, remaining budget, prior effect, or sandbox profile.

Every case reached the final gate and stopped before adapter invocation. Concurrency tests raced membership revocation with queued work and two workers against one receipt.

External conditional-request fixtures changed state after the local check and verified conflict handling rather than false success.

The test suite treated time between yes and act as an adversarial surface.

In the original scenario, the final gate found three mismatches: repository digest, expired receipt, and destination policy. It recorded all safe reasons that could be disclosed and did not call the tool.

The agent proposed rebasing the patch and local preview. The reviewer could inspect a new artifact under current policy. The old green approval remained in history and had no executable power.

The system looked less automatic and behaved more correctly.

Policy belongs where consequence begins

Early policy helps planning, reduces wasted work, and keeps unavailable tools out of context. Approval gives a person control over a materialized action. Neither can guarantee the world stays still while execution waits.

N17Q therefore treated every allow as evidence bound to its moment. The last deterministic gate re-established current identity, exact arguments, authority, approval, budgets, mappings, prior effects, and world preconditions before an adapter crossed the boundary.

Some remote races remained and were handled with conditional requests, idempotency, receipts, and explicit uncertainty.

The policy gate belonged immediately before execution because that was the last place the product could still choose not to act.