Bind what an agent proposes to independently supplied authority, constrain the effect, and reconstruct what happened from the retained record.
The Manifest-bound operation, target, amount and commitment.
The Control Plane decision, revalidated just before the effect.
Each durable attempt and its acknowledgement, or the lack of one.
What the destination was seen to do: applied, absent, partial.
Independent confirmation, which the reference does not claim.
Bounded synthetic reference. One refund workflow · synthetic SQLite destination · one host · no production credentials. Not a production deployment, OS security boundary or compliance certification. Public release is pending approval.
Head to head on identical scoring, Cognous’s optional ProtectedDestination profile delivered stronger request admission than an OPA transactional application and a LangGraph plus OPA application — with zero unexpected destination effects.
Five repetitions per scenario in each of two seeded runs.
Repeated trials passed by Cognous, against 130 for each comparator.
Unexpected destination effects from Cognous, against 50 for each comparator.
Corner-case denials with correlated evidence retained by Cognous.
| INVALID REQUEST | COGNOUS | COMPARATORS |
|---|---|---|
| Unknown argument, body or verifier fields | Rejected | Accepted |
| Empty effect identifier | Rejected | Accepted |
| Invalid operation | Rejected | Accepted |
| Exact-command replay | Rejected | Duplicate receipt returned |
On the original 24-scenario baseline all three configurations tied at 480 of 480 repeated trials. The advantage is integrated admission validation and auditable refusal at the effect boundary — a policy decision or durable workflow alone does not supply every application-level control needed there.
Scope: Cognous-authored, code-informed tests using synthetic SQLite effects and identical scoring criteria. Comparators are our configured applications, not vendor-certified implementations; OPA and LangGraph can add equivalent checks. Not evidence of universal product superiority, a commercial-system ranking, independent certification or production readiness. Tested commit bf07897.
As agents move from drafting text to issuing refunds and changing records, review has to change too. A chatbot is reviewed by what it said; an agent must be reviewed by what it was allowed to do, what it attempted and what the destination was observed to do.
The Open Control Stack keeps those facts separate and connected.
Each request leaves a reconstructable record — including the one the stack does not prevent.
Within the grant. Rechecked just before the effect; executed once.
Outside the grant. No attempt is made; the denial is recorded.
Same proposal, same effect ID. Redelivery returns the original record.
A different valid proposal gets a new effect ID. Effect-ID dedup is not business-intent dedup.
Action · target · scope · effect limits
Action Manifest →Authority supplied outside the request · rechecked just before the effect
Control Plane →Attempted · acknowledged · observed · reconstructed
Replay Bundle →Linked to source · gaps left visible
Governance Evidence Pack →Authority Context is supplied by a trusted resolver; the incoming message cannot grant it.
Per effect only: not whole-workflow or check-to-commit atomic.
A changed payload, target or adapter produces no effect.
A timeout is recorded as unknown, never as “nothing happened.”
Trace every step without rerunning anything.
Each component owns one responsibility and states what it does not establish. Governed Exchange connects the groups. The rule: evidence is not permission.
Register evidence commitments and verify issuer provenance under explicit trust assumptions.
Describe institutional authority and its contracts; proposed authority is distinct from operative authority.
Declare proposed actions and evaluate them against independently supplied authority.
Execute bounded operations through the constrained runtime and destination boundary.
Reconstruct retained records and carry traceable evidence for review.
Support evidence-bounded reasoning and human review through optional instruction protocols.
On the side, not in the path. Evidence Attestation and the Evidence Registry form a separate evidence path for signed claims and commitments. PRP, Research Intelligence and TFA shape how models reason and respond. None is an enforcement dependency, and none can authorize an effect.
Agent: refund agent. Declared action: routine refund in the Action Manifest. Authority: a grant supplied by a trusted resolver, outside the incoming request. Destination: a synthetic SQLite refund table.
| Case | What happens | What the record shows | What it does not establish |
|---|---|---|---|
| 1Refund within the grant Allowed | Control Plane allows; critical inputs are rechecked just before the effect; the runtime executes the frozen operation once. | Decision, revalidation, attempt and an observed “applied” state. | Independent verification; that authority could not change between recheck and commit. |
| 2Refund outside the grant Denied | Control Plane denies. No attempt is made. | The proposal, the denial and the authority it was evaluated against. | That the grant itself was well designed. |
| 3Payload changed after approval Rejected | Amount, target or adapter no longer matches the frozen envelope. The runtime rejects it. | A rejected attempt and no effect. | OS confinement: a privileged host process could bypass the package. |
| 4Timeout after the attempt Unknown | Acknowledgement unknown. Reconciliation concerns the original effect; a later observed absence does not authorize a replacement. | Unknown acknowledgement, observations and reconciliation, with the interrupted history kept. | Remote finality or exactly-once delivery. |
| 5Authority changes before recovery Recovery denied | Recovery is denied under current authority. | Both facts, separately: the historical applied effect and the current denial. | Rollback or cancellation of the original refund. |
| 6Same message delivered twice One refund | Same proposal, same effect_id. Redelivery returns the original retained artifacts. | One effect, with the redelivery linked to it. | Cross-host or remote exactly-once delivery. |
| 7Same refund, new proposal Known limit | A second valid proposal for the same customer refund has a new commitment, so a new effect_id. Both can execute. | Two separate effects, each fully traceable. | Business-intent deduplication on the default path. The optional refund-intent profile blocks it, but is not enabled by default. |
Effect ID is not business intent. Deduplication keys on the effect a specific proposal names, not on what the business meant. An optional refund-intent profile binds one intent to one effect, but the default path does not enable it; otherwise a deployment must guard business intent itself, for example with an idempotency key on the destination.
Each accepted claim is tied to executed evidence and a stated boundary.
One refund workflow and a single agent, followed end to end.
A SQLite destination. No real accounts, payment services or production credentials.
Cooperating writers on documented local Linux filesystems, on one host.
Public contracts, code, tests and retained failures you can rerun.
| Area | ✓ What holds in the reference | ✕ What does not |
|---|---|---|
| Authority | Authority Context is supplied by a separately configured trusted resolver and resolved outside the incoming request. | Production resolver authentication and credential custody. |
| Effect time | Authorization-critical inputs are revalidated immediately before each effect. Individual record transactions are protected. | Check-to-commit atomicity by default. The optional same-host profile (C1) is off by default. |
| Duplicates | Same-effect deduplication by effect_id, including across processes sharing one SQLite file. | Business-intent deduplication on the default path; the refund-intent profile is separate and optional. |
| Execution | Application-level restrictions on the supported path, using a frozen operation snapshot. | OS confinement, live OpenShell and deployment-wide bypass resistance. |
| Delivery | Reconciliation of the original effect, with interrupted history kept. | Rollback, cancellation, remote finality and exactly-once delivery. |
Public contracts, code, tests and retained failures. A missing, skipped, failed or unexecuted required scenario blocks the release gate.
All resolved; required suites run twice.
Fresh October 13 reproduction.
Same reproduction.
Passed in a separate run; off by default.
Read the output as input. The reference’s output is input to human governance review. It does not amend policy, confer authority or approve deployment. Publication and operational trust remain on hold; newer component releases are not selected automatically.
Runs locally with no production credentials, Docker or OpenShell. Run one bounded refund and read what it leaves behind.
Linux with Git. Reference CI runs on Ubuntu.
Python 3.11 with venv and pip; Node 20 and npm.
GitHub clones and Python and npm package downloads.
Production credentials, Docker or an OpenShell installation.
Start with results/reference/scenario-results.json. A passing characterization of a known limitation, such as case 7, does not mean the limitation was prevented. The runner deploys no services, writes to no public chain and provisions no infrastructure.