Architecture Center
Proposal and decision gating
Isolate the fragment where advancing state requires a proposal plus a decision by an authorized actor, recorded as events.
previewpatternContract >=0.8 <1.0Reviewed 2026-07-20
Problem statement
When any actor can both propose and commit, there is no review boundary. Gating splits the two so a worker can propose without being able to execute.
When to use
- Sensitive state transitions need review.
- Automated workers should propose but not commit.
- You need an auditable record of who decided what.
When not to use
- Trivial, low-risk transitions where review adds only latency.
Flow
ProposalLegal-action checkDecision requestAuthorized decisionState advancesAudit event
Resource inventory
- Proposal
- A requested transition, not yet committed.
- Decision
- The authorized resolution that advances state.
- Authority + policy
- Determine who may decide.
Failure modes
- Decision required
- Work cannot advance until an authorized decision is recorded.
- Worker authority exceeded
- A propose-only worker attempting to commit is denied.
Security controls
- Authority resolved by the kernel per actor and state.
- Every proposal and decision is auditable.
Deployment checklist
- Reviewer authority defined.
- Worker ceilings set to propose-only where a human should decide.
- Audit projection monitored.
Related quickstart: Request and resolve a decision →