Concept

Decision governance

Authority answers may this agent call this tool. A Decision answers the question a business actually asks: was this action allowed to happen, on these facts, right now. A Decision is the smallest business action you would want to govern on its own — issue the refund, release the payment, publish the record.

Declaring a Decision is optional. Runs without one are governed exactly as before by authority alone, and carry no Decision on the receipt.

The chain

Decision → Schema → Inputs → Participants → Verdict → Evidence

• Schema is the contract. It declares the inputs a Decision requires — name, nominal type, identifier field, acceptable provenance, classification, and validity. The grammar is closed: no expressions, no conditions, no branches. Aarmos validates the contract; it never interprets your business rules.
• Inputs are typed facts. Provenance is assigned by the runtime at ingest, never accepted from the caller. A missing or invalid input fails closed. Validity is checked across four independent dimensions — freshness, expiry, revocation, and observation window — and every failing dimension is reported, not just the first.
• Participants are the evaluators bound to the Decision. Each sees only the facts it is responsible for. A participant that cannot evaluate returns unable, and its declared posture — deny or step-up — applies. Allow is unrepresentable in that case.
• Verdict is ALLOW, DENY, or STEP_UP, and it authorises execution only inside a bounded window. Outside the window, the verdict is revalidated before commit.
• Evidence is the Decision envelope on the receipt: schema version and hash, every input with its provenance and satisfaction state, every participant outcome, the verdict, and the window. It is covered by the entry hash and the signature.

What Aarmos will not do

• Infer a fact that was not declared, or a participant that was not bound.
• Read or store input payloads. The envelope records identifiers and references.
• Treat a human approval as a substitute for a missing input. An approval satisfies a step-up; it never manufactures a fact.
• Interpret business logic. Invariants live in your evaluators; Aarmos records the verdict.

Where you see it

Any receipt produced under a declared Decision renders the Decision section — verdict, schema, inputs, and participants — on its receipt page, and in the exported markdown. Verification is unchanged: the field is additive and optional, and both the Aarmos verifier and the public AVAR verifier reproduce receipts with and without it.

Normative fixtures: 14-decision-allow, 15-decision-unable.