Architecture Center
Evidence-gated external execution
Show how Crescevo primitives combine so that a real external effect runs only when it is legal, and always produces a durable receipt.
previewreferenceContract >=0.8 <1.0Reviewed 2026-07-20
Problem statement
Systems that act on the outside world often do so before their outputs are grounded or approved. Once an effect runs, it cannot be un-run. The pattern gates the effect behind evidence, a decision, and policy.
When to use
- An output must be traceable to its evidence and to an authorizing decision.
- An effect reaches an external system and should not run on ungrounded work.
- You need a durable, auditable record of what ran and who authorized it.
When not to use
- Purely internal, reversible computation with no external effect.
- Work where no review or evidence requirement applies and latency is the only concern.
Flow
InputSessionWorker proposalArtifact revisionClaimsEvidence validationDecision requestAuthorized approvalCommandExternal effectReceiptProjection
Resource inventory
- Session
- Bounds the work and carries the typed timeline.
- Artifact revision
- The versioned output a worker proposes.
- Claim + Evidence
- Grounds each assertion; coverage gates the effect.
- Decision
- The authorized approval that unlocks the command.
- Command + Effect
- The validated operation and its external result.
- Receipt
- The durable record: result, authorization, idempotency key.
Failure modes
- Evidence threshold not met
- The command stays illegal; attach the missing evidence and retry.
- Policy denied
- Read the unmet condition, satisfy it via a legal path; the denial stays in history.
- Effect failed (retryable)
- Retry with the same idempotency key so the effect applies at most once.
- Effect failed (permanent)
- Inspect the receipt, correct the cause, issue a new command.
Security controls
- Tenant isolation on every resource in the flow.
- Authority and policy enforced by the kernel on every write, not the client.
- Irreversible effects never shown complete before their receipt is recorded.
- Workers bounded by an authority ceiling.
Deployment checklist
- Blueprint version pinned and validated for the tenant.
- Evidence policy defined for the gated claims.
- Effect destinations allowlisted per environment.
- Idempotency keys applied to all external commands.
- Audit projection monitored.
Related quickstart: Create your first governed session →