Authority expands silently
Permission to prepare is treated as permission to commit.
Control to examine: Keep the send operation behind an explicit scope check.
Run the fictional agent exampleThese records put unlike systems beside one another without pretending they share the same evidence, authority, or consequence.
7 STRUCTURED RECORDS · SOURCED TO WORKING MANUSCRIPT DRAFTS
These are reading lenses and design questions, not independently validated diagnoses. Historical cases retain their source limits; agent examples are fictional.
Permission to prepare is treated as permission to commit.
Control to examine: Keep the send operation behind an explicit scope check.
Run the fictional agent exampleA reviewed candidate changes before the action occurs.
Control to examine: Bind the review to the exact text and the permission to the destination; changed text needs a new review.
Test a stale reviewOne completed step is mistaken for completion of the entire transaction.
Control to examine: Name each finality boundary and what remains outside your control.
Read the settlement caseA completed checklist is mistaken for evidence that the underlying requirements were satisfied.
Control to examine: Measure what the process establishes, not simply whether it was adopted.
Read the checklist contrastA missing acknowledgment is treated as proof that nothing happened.
Control to examine: Resolve the first outcome and design durable duplicate prevention before retrying.
Explore the fictional retry scenario| System | Observed and represented | Commitment boundary | Authority | Read |
|---|---|---|---|---|
| 001 / AVIATIONRejected takeoff at V1A named decision boundary | Airspeed, runway remaining, aircraft condition, and the operating conditions used in runway analysis. | The manuscript treats V1 as the practical decision boundary for this example; the diagram is a general form and not an operating reference. | The flight crew, acting under applicable training, procedures, and aircraft-specific data. | Open record |
| 002 / FINANCEThe Herstatt settlement gapTwo obligations, different settlement times | The payment instruction, local settlement status, bank condition, and whether the counter-currency has reached final settlement. | The exposure begins when the sold-currency payment can no longer be canceled unilaterally and ends when the purchased currency is received with finality. | Counterparties, banks, and settlement-system rules distribute control; no one party can unilaterally make the other leg final. | Open record |
| 003 / HEALTHCAREThe surgical checklist contrastA pause versus what becomes established | The patient and planned intervention, confirmed aloud by the team immediately before incision. | The pause is placed immediately before the first incision, while the procedure can still be stopped before that irreversible step. | The clinical team under its institutional protocol; the checklist alone does not confer authority. | Open record |
| 004 / TRADE FINANCEWhen a document discrepancy becomes a questionTyped discrepancy and delegated resolution | The presented documents and their consistency with the terms of the credit—not the goods themselves. | Payment is the commitment. Before it, discrepancy notice and waiver preserve a deliberate decision point; after payment, recovery is not the same as reversal. | The issuing bank decides its document-compliance response; the applicant decides whether to waive discrepancies and accept the commercial risk. | Open record |
| 005 / SPACEFLIGHTThe number that crossed without its unitsA declared interface without enforced meaning | Numerical thruster-performance values produced by SM_FORCES. | For the interface-design lesson, the intervention point is before incompatible data enters a navigation calculation. This is an editorial boundary, not a reconstruction of the last physically recoverable mission maneuver. | The engineering interface specification declared the requirement; the investigation board later identified its violation. | Open record |
| 006 / TRADING SYSTEMSNinety-seven warnings before the market openedWarnings without a binding stop | Which software each server ran, the resulting warning messages, and the orders entering the market. | The boundary of interest is before orders enter the market. An alert is useful only if its resolution is connected to authority to proceed or to stop. | The firm controlled its deployment and market-access systems; the SEC subsequently assessed the missing controls. | Open record |
| 007 / COMPUTER SECURITYCode that carries a checkable argumentAn untrusted producer and a narrow checker | The submitted code and the proof accompanying it. | Before admitting the untrusted code to execution under the protected consumer’s privileges. | The code consumer chooses the policy; the checker establishes whether the submitted evidence meets it. | Open record |
Aircraft speed, two currencies, a surgical pause, a stack of trade documents: each is a different object with its own evidence and authority. Compare them by asking what the representation can establish, what remains outside its view, and who absorbs the unresolved risk.
Open the case register