Locate Tools, State, and Human Authority

The executor owns the effect

A trusted executor validates the typed request, caller, resolved target, permission, approval, budget, and idempotency key before acting. The model does not grant itself access.

The result must distinguish refusal, validation failure, accepted work, completed effect, timeout, and unknown outcome. A timeout after a possible write cannot safely be retried until reconciled.

State has different purposes and owners

Working context helps the current decision. Durable workflow state survives restart. Memory retains governed facts or preferences. Audit evidence records accountable events. Treating all four as a chat transcript creates privacy and recovery failures.

For each state class, record writer, reader, source, version, retention, correction, deletion, and conflict behavior.

Approval binds a person to an exact action

A meaningful approval identifies the action, target, parameters, evidence, approver authority, time, expiry, and permitted variation. Confidence or prior approval does not authorize a changed target.

People retain authority over scope, consequential effects, exceptions, learner assessment, and publication. A model can recommend but cannot create that authority.

Unknown outcomes require reconciliation

Recovery starts from observed state, not from the agent's narrative. Inspect the real target, correlate the request, classify effects, and choose resume, retry, compensate, roll back, or escalate.

A truthful agentic system can end failed, blocked, cancelled, budget-exceeded, needs-approval, or unknown. Converting uncertainty to success hides risk.

Practice activity

Build a responsibility and evidence map

Choose one tool-using experience and trace a proposed action through validation, authorization, execution, result, and postcondition.
Map working context, durable state, memory, and audit evidence to their owners and lifecycle controls.
Define the exact human approval boundary and at least two terminal outcomes other than success.
Challenge the design with an unauthorized target and a timeout after a possible write.

What to produce

A responsibility map for identity, tools, state, approval, verification, and recovery.
Failure traces showing fail-closed authorization and reconciliation before retry.

Reflect before continuing

Which boundary would be most dangerous to leave implicit?