Energy & critical infrastructure
Where the effect is physical and the undo does not exist
An actuation reaches equipment. There is no compensating transaction for a valve, a breaker or a setpoint, so the authority decision has to be made before the command leaves the governed boundary.
The actions that are not recoverable here
Governance is worth its cost where the effect cannot be undone by correcting a record.
Setpoint and threshold changes
A parameter change is a small instruction with a large physical consequence, and it is rarely limited by the same controls that guard a shutdown.
Switching and isolation
Commands that change topology need an approver with the required role, bound to that exact command rather than to a class of commands.
Scheduling and dispatch
Automated scheduling touches physical capacity. Limits have to be reserved before dispatch, not checked after the fact.
Maintenance and override modes
Modes that relax normal protections are exactly the class that must be prohibited outright for an agent, with no approval able to release them.
What a reviewer will ask
Each of these is answered by an artifact rather than by a description of a process.
Which identity issued the command, established from a credential rather than a field
Answered from the signed decision record: acting identity, principal, policy version, decision, approver where one exists, and the execution result.
Whether the command was inside the authority envelope in force at dispatch
Answered from the signed decision record: acting identity, principal, policy version, decision, approver where one exists, and the execution result.
Whether an operator approved it, and whether that approval was single-use
Answered from the signed decision record: acting identity, principal, policy version, decision, approver where one exists, and the execution result.
Whether a crash between commit and acknowledgement could have repeated it
Answered from the signed decision record: acting identity, principal, policy version, decision, approver where one exists, and the execution result.
The controls that answer them
Pre-execution authorization
ProvenEvery governed action is authorized before it executes, not observed after. The decision to allow, hold or deny is taken against the active policy inside the same write transaction that reserves the budget and consumes the approval, so a policy change lands entirely before or entirely after an action — never halfway through one.
Human approval, bound and single-use
ProvenAn action held for approval produces no effect until a separately authenticated human with the required role approves that exact request. The approval is bound to the payload and the envelope, is consumed once, and cannot release a different action or the same action twice.
Budget and action limits
ProvenSpend and action limits are reserved atomically inside the authorization transaction. A limit lowered below what is already spent stops further spend without rewriting history, and the change is recorded as a signed configuration record naming the principal who made it.
Revocation of agent authority
ProvenAn authorized operator can revoke an agent. Its next request cannot execute, and an action it had already had approved but not yet dispatched cannot execute either — revocation reaches work already in flight, not only new requests.
Signed, hash-linked evidence
ProvenEach decision, authorization, outcome, refusal and configuration change is written as a signed record in a hash-linked chain. The record carries the request identity, the policy version, the decision, the approver where one exists, timestamps and the execution result.
Offline independent verification
ProvenEvidence is verified by a portable verifier with no database, no signing key, no network and no product installation on the path. Deliberately altered evidence — an edited amount inside a signed body, a stripped signature, a broken chain link, a checkpoint re-signed by the writer's own key — is refused, and a verifier that cannot run reports an instrument failure rather than a refusal.
Limitation · The verifier was written by the same party as the system it checks. Verifying with it confirms signatures, linkage and key separation; it is not a substitute for an independent implementation of the documented record format.
Relevant frameworks
EU AI Act, NIST AI RMF, ISO/IEC 27001 control mappings. Coverage is stated control by control, with gaps named. ApexClaw holds no certification and displays no certification badge.