Skip to case
TWILIGHT TECH LABSTHE ENGINEERING PROJECT BOOK
Case index
ENGINEERING INDEXJ-BOT / GOVERNED ACTIONS

AUTHORIZATION PLANE // LOCAL QUALIFICATION

Permission is
a system.Not a prompt.

J-Bot can propose an action. That does not mean it has authority to take it—or proof the outside world received it. This newer bridge makes those boundaries explicit; it is one case within J-Bot, not the status of the whole platform.

THIS COMPONENT Locally testedFOCUSED TESTS 24 passedREAL PROVIDER Not yet exercised

THE MECHANISM

One action. Five distinct states.

The handoff matters most where a model stops making a suggestion and software might change the world.

  1. 01

    Prepare

    Typed action + tenant scope

  2. 02

    Freeze

    Payload hash + idempotency key

  3. 03

    Authorize

    Human gate where risk rises

  4. 04

    Execute

    Fenced attempt + local receipt

  5. 05

    Prove

    Provider + terminal evidence

A possible external effect is not automatically retried after a crash. It is recorded as uncertain until reconciled.

THE TEST RECEIPT

What we checked.

These are focused local checks against the governed-actions sidecar, not a claim about production connectors or every J-Bot workflow.

24/24focused tests passed
rechecked September 25, 2026
01Unknown actions stop hereInspect

The authority matrix denies action types it cannot classify.

Test receipt
Focused policy-denial test passed.
Boundary
This covers the sidecar path, not every live J-Bot tool.
02Approval belongs to one exact requestInspect

A durable approver is bound to the prepared payload and its hash.

Test receipt
Payload-binding and approval tests passed.
Boundary
A synthetic approval does not authorize real external work.
03Running is not deliveringInspect

Execution, provider delivery, and workflow completion have separate receipts.

Test receipt
Synthetic provider-receipt and terminal-gate tests passed.
Boundary
No real provider delivery was exercised.
04An uncertain effect stays uncertainInspect

After a possible external effect, recovery fences the action instead of replaying it blindly.

Test receipt
Duplicate, fault-injection, and restart-recovery tests passed.
Boundary
No live connector restart drill was run.

CURRENT EDGE // NO POLISH OVER THE GAP

The bridge is real. The rollout is not assumed.

The qualification uses synthetic providers. The next proof is to trace a real J-Bot tool into this path, then observe a controlled provider interaction and its delivery receipt. Until then, this is a locally tested architecture—not production-wide governance.