Chapter 10 – The Protected Control Plane (The Guardrails)

A run cannot widen its own authority, rewrite its required check, or admit its own candidate.

The organization that adopts policy and admits effects remains accountable. Automatic admission does not transfer responsibility to a model; it executes delegation the organization approved in advance.

Authority Is Declared Per Property

Code, prose, and tests do not occupy one universal hierarchy. Authority depends on the property being decided.

An artifact may play different roles for different properties. A schema can define an API shape and be observed Terrain for a schema inventory. A candidate-supplied test may support a behavior claim without being the sole protected check authorized to decide it. CI enforces adopted decisions; it does not create the intent it enforces.

The control plane is therefore not a higher source of truth. It preserves the authority declared for each property while a candidate is produced and considered for admission.

Close the Trust Root

The trust root is the complete set of mechanisms that ordinary work must not be able to weaken. The practical test is simple: what must stay outside ordinary write authority? Common answers include:

• activated Missions, effect policy, routing, and approval rules;
• the runtime components that mediate effects, resolve protected checks, route decisions, and seal results;
• protected contracts, acceptance tests, policy checks, and output schemas;
• CI and admission configuration, ownership rules, and bypass lists;
• scheduler state, credentials, deployment permissions, and kill state;
• the protected audit sink and its retention policy.

Some controls live in the repository. Others live in source control, identity, CI, scheduling, or deployment systems. Repository protection cannot secure an off-repository bypass list. Observe those settings as Terrain and compare them with the governance Map.

Candidate code and documentation may change inside declared scope. Candidate-supplied tests remain supporting evidence. Protected contracts, checks, admission rules, credentials, and audit controls remain outside ordinary write authority.

Two Paths, Two Authorities

The control plane must evolve without giving ordinary work a privileged mode.

An ordinary Mission receives a fixed work contract and bounded effects. Attempts to touch protected controls are denied during execution and rejected again at admission.

A Governance Mission is activated separately for one exact protected surface and one fixed base. It produces a checked proposal in an isolated workspace under stronger approval and validation rules. A different authorized identity applies the exact proposal. Independent owners and the governance admission policy decide whether it takes effect.

Completion is not adoption. A Governance Mission may successfully produce its declared proposal while the protected control remains unchanged.

Enforce the Complete Effect Boundary

Filesystem paths are only one effect surface. The implementation varies; the portable requirement is that ordinary work cannot perform or conceal an undeclared effect:

A read-only file permission is not a complete boundary if the worker owns the files, can remount them, can invoke a privileged helper, or can reach a host control socket. Enforce the boundary outside the worker’s authority. Depending on risk, that may require separate identities and namespaces, read-only mounts, dropped capabilities, system-call filtering, isolated networking, a virtual machine, or a microVM.

The runtime’s enforcement of this declared effect envelope is the Scope Guard. It checks attempted effects before application and records attempted and applied effects separately. If an effect cannot be mediated, the Mission does not possess it.

Recompute the Candidate Independently

Admission must not trust a model-supplied path list or summary. A protected Sensor computes the actual candidate changeset from the fixed base and candidate using the version-control system’s structured diff.

The comparison must account for both endpoints of renames, file-mode and type changes, symlinks, and untracked outputs. It must normalize paths, enforce repository containment, and identify the protected policy used for the decision. Missing, ambiguous, or stale revisions block admission. A disagreement between runtime effect records and the independently computed diff is an evidenced failure.

Use one small trusted admission-dispatch step for every candidate. It computes the complete effect set, applies baseline control-plane policy, and invokes deeper checks required by the observed change. Platform path filters and ownership features may optimize routing, but they are not the trust boundary.¹

The Mission Gate

The independent admission check is the Mission Gate. It runs without the model and verifies:

• the exact activated Mission, base, candidate, policy, and protected check versions;
• the complete observed effects and diff against declared authority;
• every required check and declared output contract;
• required approvals and routing predicates;
• the absence of missing or contradictory evidence.

Completion and admission remain separate. Base drift after proposal closure produces this sequence:

The sealed run remains unchanged. Its successful result says that the workflow produced a supported proposal under the evidence then available. The later gate denies admission because the current base no longer matches that evidence.

Humans need not approve every low-risk instance. Adopted policy may automatically admit a narrowly defined low-risk class supported by comparable evidence. The gate still applies organizational authority rather than model authority.

The practical consequence is that higher proposal throughput does not require a direct path from generation to production. Admission can scale by risk class while the rules that authorize production effects remain independently controlled.

Emergency and Stop Controls

Break glass is an emergency Governance Mission, not an unbounded bypass. It must:

• bind the exact incident, target, effects, base, reason, and restoration plan;
• require independent approval and expiring least privilege;
• write to an audit sink the responder cannot alter;
• restore ordinary controls automatically; and
• run the full protected checks afterward.

A complete kill mechanism has two independent jobs:

• Stop execution: prevent new work, cancel active work, and revoke credentials at systems that enforce the effects.
• Stop admission: make an always-required external gate reject merge or deployment while authoritative kill state is active, missing, stale, or unreadable.

The worker cannot own the kill state or its reset authority. A cooperative environment variable may be a signal, but it cannot revoke credentials, stop direct external calls, or cover bypass roles by itself.

Enforcement Evidence

A denied ordinary effect and a later Governance Mission are separate histories. The first retains the attempted protected write, the absence of an applied effect, the finding, and the evidenced failure. The second may retain a supported proposal whose adoption is still pending.

Any protected diff after a claimed denial, successful summary over a required failure, or adopted change without independent admission is a contradiction. Under the protected sink and trust-root assumptions developed in Chapter 12, the evidence path must reject that account.

The Protected Control Plane keeps autonomy delegated rather than sovereign. It turns the versioned change-process contract into an independently enforced boundary: undeclared effects are denied, the candidate is recomputed independently, and changes to governing rules move onto a separate path. Chapter 11 uses that boundary to govern structural self-modification.