PÓLYABoundary and security

BOUNDARY · NO AUTHORITY

CONTRACT REVIEW · TEST_ONLYReview-candidate contract and local fixture evidence only · no distributed SDK, operational API, publisher parity, or decision authority

Keep decision structure separate from authority.

What PÓLYA may receive, which lineage it must preserve, and which authority and execution surfaces stay closed.

01

Receive verifiable opaque references instead of source bodies

  • Approved tenant and exact case scope
  • SignalBriefRef with publisher, schema, key, and expiry
  • DecisionCaseRef bound to a canonical digest
  • EligibilityGateRef exactly bound to actor and current case ref
02

What PÓLYA does not own

A Decision node preserves what a person recorded. Whether that record is a lawful approval and who may take which action belong to RAIFFA and the organization’s actual policy.

  • Fact authority
  • Recommendation or final-choice authority
  • Approval or rejection authority
  • External work assignment and action dispatch
  • Payment, deployment, scheduling, or production runtime
03

Separate what is open from what remains closed

  1. 01
    OPEN FOR REVIEW

    Documentation, type declarations, JSON Schemas, and local deterministic test evidence

  2. 02
    TEST_ONLY

    HMAC fixtures, in-memory replay guard, Decision Room local adapter, and credit-deterioration example

  3. 03
    NOT_READY

    HARBINGER and RAIFFA publisher parity and operational interop contract

  4. 04
    NOT PROVIDED

    Public SDK distribution, operational API, customer Sandbox, production support, or authority issuance