---
title: "Keep decision structure separate from authority."
description: "What PÓLYA may receive, which lineage it must preserve, and which authority and execution surfaces stay closed."
updated: "30 August 2026"
availability: "CONTRACT REVIEW · TEST_ONLY"
candidate_route: "/docs/polya/boundaries/access-security"
---

# Keep decision structure separate from authority.

What PÓLYA may receive, which lineage it must preserve, and which authority and execution surfaces stay closed.

**CONTRACT REVIEW · TEST_ONLY:** Review-candidate contract and local fixture evidence only · no distributed SDK, operational API, publisher parity, or decision authority

## Receive verifiable opaque references instead of source bodies

- Approved tenant and exact case scope
- SignalBriefRef with publisher, schema, key, and expiry
- DecisionCaseRef bound to a canonical digest
- EligibilityGateRef exactly bound to actor and current case ref

> **Do not include:** Do not add raw evidence, customer credentials, secret keys, session tokens, or publisher payloads to contract fields.

## What PÓLYA does not own

A Decision node preserves what a person recorded. Whether that record is a lawful approval and who may take which action belong to RAIFFA and the organization’s actual policy.

- Fact authority
- Recommendation or final-choice authority
- Approval or rejection authority
- External work assignment and action dispatch
- Payment, deployment, scheduling, or production runtime

## Separate what is open from what remains closed

1. **OPEN FOR REVIEW** — Documentation, type declarations, JSON Schemas, and local deterministic test evidence
2. **TEST_ONLY** — HMAC fixtures, in-memory replay guard, Decision Room local adapter, and credit-deterioration example
3. **NOT_READY** — HARBINGER and RAIFFA publisher parity and operational interop contract
4. **NOT PROVIDED** — Public SDK distribution, operational API, customer Sandbox, production support, or authority issuance

---

Published route: /docs/polya/boundaries/access-security