Build against a precise decision authorization contract.
TracePoint exposes versioned contracts for actors, accountable principals, delegated authority, proposed actions, policy outcomes, authorizations, execution receipts, and recovery context.
The client proposes. TracePoint evaluates authority. The connector enforces.
A proposed action enters a deterministic lifecycle. Policy and delegated authority produce ALLOW, DENY, or ESCALATE. An allowed action receives a time limited, action bound, single use authorization. Execution produces a receipt and connects any available recovery context to the same Decision Record.
Describe the exact actor, purpose, target, and requested outcome.
Apply the pinned authority envelope and policy version.
Resolve defined exceptions through an accountable owner.
Issue an authorization bound to the approved action.
Verify authorization at the enforcement point.
Return a connected receipt and ordered evidence.
Retain remediation and reconciliation context.
One canonical workflow result across every decision endpoint.
Evaluation, review, execution, and reversal return the same DecisionWorkflowResult envelope. Nullable objects remain present as null until their lifecycle stage exists. This removes client-side envelope switching and makes undocumented runtime fields a contract failure.
POST /api/reference/v1/evaluate
{
"identityAssertion": {
"issuer": "urn:tracepoint:local-identity",
"subject": "workload://local-product/service-operations/agent",
"organizationReference": "org://local-product",
"actorType": "WORKFLOW_AGENT",
"audience": "tracepoint-authorize-local",
"assuranceContext": "Actor identity verified by the local trust source.",
"authenticatedAt": "2026-08-19T08:00:00.000Z",
"expiresAt": "2027-08-19T08:00:00.000Z",
"signature": "local-product-identity-assertion-v1"
},
"actorIdentityReferenceId": "agent-service-operations-01",
"actionType": "PRODUCTION_CONFIGURATION_CHANGE",
"targetService": "customer-facing-service",
"targetResource": "service://customer-facing-service/primary",
"environment": "production",
"changeType": "TRAFFIC_SHIFT",
"changeScopePercent": 5,
"sourceEnvironment": "primary",
"destinationEnvironment": "secondary-approved",
"declaredPurpose": "SERVICE_RESTORATION",
"changeReason": "Restore customer service",
"recoveryPlaybookReference": "service-recovery-standard",
"rollbackPlanReference": "rollback://local-operational-change",
"requestedOutcome": "APPLY_CONTROLLED_SERVICE_CHANGE",
"idempotencyKey": "operational-change-example-001"
}{
"action": { "actionDescriptor": { "actionType": "PRODUCTION_CONFIGURATION_CHANGE" }, "changeScopePercent": 5 },
"decision": { "disposition": "ALLOW", "state": "AUTHORIZATION_ISSUED" },
"approval": null,
"authorization": { "status": "ACTIVE", "allowedOperation": "APPLY_CONTROLLED_SERVICE_CHANGE" },
"receipt": null,
"recoveryContext": null,
"evidence": [],
"duplicate": false
}Stable decision language, with action-specific Control Packs.
The core contract describes institutional authority without embedding one workflow into every domain. A Control Pack profiles the action type, typed context, policy rules, and connector behavior for a specific workflow. Consumers should pin versions in each Decision Record and treat breaking changes as new contract versions.
Refusal and uncertainty are explicit outcomes.
Clients should branch on HTTP status, structured error code, and decision disposition. They should never infer permission from network access or a missing response. Idempotency keys protect repeated evaluation, while action fingerprints and authorization state protect execution.
Invalid request
Reject malformed or incomplete proposed actions before evaluation.
Denied authority
Return DENY with reason codes when scope, purpose, eligibility, limits, or authority do not permit the decision.
Review required
Return ESCALATE and bind the decision to an accountable review path.
Expired authorization
Refuse execution after the authorization validity window closes.
Revoked authorization
Refuse an authorization withdrawn before execution.
Consumed authorization
Reject replay after the single permitted execution attempt.
Action mismatch
Reject a payload whose fingerprint differs from the authorized action.
Uncertain execution
Preserve ambiguity for reconciliation instead of claiming a result that cannot be verified.
Recovery unavailable
Make the absence or expiry of a recovery path explicit in the connected record.
The public product environment uses local identity, process memory, and a local connector. Enterprise identity, durable storage, tenant controls, target authentication, external enforcement, availability, and operational recovery are deployment specific.