For Product / AI Teams
Autonomy is the feature. Verification is the safety net.
Ship autonomous features with externally verifiable, fail-closed gates so your product moves fast without silent liability.
No Stamp → No Execute for defined high-impact actions.
Fail-closedAppend-onlyScope-bounded
Not a certification. Scope-limited verification. Acceptance depends on counterparty/programme requirements.
Product 60-Second Brief
Problem
Autonomous execution increases product value and liability simultaneously.
Control
Status Link verification at decision time before high-impact execution.
UX Behavior
If verification is non-VALID, degrade to review (BLOCK/ESCALATE), never silent execution.
Boundary
Improves defensibility and safety; does not guarantee model correctness or outcomes.
Is This a Fit?
Best fit
- Autonomous features with high-impact actions
- Products needing safe degradation + auditability
- Teams shipping with legal/procurement review
Not fit
- Chat-only informational assistants
- Teams wanting prompt tuning only without execution controls
Three Product Outcomes
Ship safely
Autonomous features with verifiable gate controls.
Build trust
Optional user/support verification surfaces.
Degrade safely
Non-VALID routes to BLOCK/ESCALATE per action class.
Implementation Placement
Where the gate sits in your product
Gate sits in orchestrator/action executor path pre-execution
Status Link verification at runtime (verify-per-action or TTL by class)
Fail-closed mapping: timeout/TLS/domain mismatch/malformed => NOT_VERIFIED => BLOCK/ESCALATE
Optional UX surface: user badge/support context/appeals flow
User-Facing Verification States
| Badge | Status | Action |
|---|---|---|
| Verified | VALID | Proceed within scope |
| Needs review | NEEDS_REFRESH / NOT_VERIFIED / EXPIRED | Hold or route to review |
| Reliance stopped | WITHDRAWN | Stop and block/escalate per action class |
Note: user-facing verification is programme-defined (user-facing, support-only, partner-only).
Launch Controls by Action Class
High-impactFail-closed (BLOCK/ESCALATE)
Irreversible or boundary-crossing actions
Medium-impactDegrade-to-review
Reviewable actions with user impact
Low-impactAllow with monitoring (optional)
Reversible actions, internal operations
Action classes are buyer-defined and programme-scoped. See /kill-switch for enforcement semantics.
Stamp Sprint (30 Days)
One lane live: fail-closed gating + Status Link verification + dispute-ready Evidence Pack.
1
Scope & UX1–3 features + action classes + placement
2
Integrate gateVerification + logging + evidence
3
Failure drillsTimeout/TLS/domain mismatch + refresh/withdrawal + escalation
4
Launch packetEvidence specimen, UX copy/screens, rollout + metrics
Definition of done: Selected workflow blocks on status ≠ VALID for the chosen action class.
Metrics
Buyer-selected
Added latency per gated action
Allowed vs blocked vs escalated rates
Override/exception rate + time-to-resolution
Appeal/dispute rate (if applicable)
Refresh/withdrawal frequency
User trust proxies (complaint/support impact)
Pilot includes latency budget and caching policy (verify-per-action vs TTL) by action class.
Responsibilities
RACI-lite
Buyer
Action classes, UX, retention, escalation path, gate operation
Supplier
Status Link semantics/specs, evidence refs, refresh/withdraw signaling
Guardians
Exceptions/appeals only, conflict-checked independence
Forwardable Kit
Share with internal stakeholders
Procurement Fast-Path
"High-impact [ACTION_CLASS] SHALL require a valid externally-verifiable Status Link (No Stamp → No Ship)."
See /clause-pack for exhibit templates.
Risk Reduced vs Out of Scope
Risk reduced
- Silent high-impact execution
- Unverified reliance
- Stale verification after material change
- Exception decisions without auditable trail
Out of scope
- Underlying model correctness/accuracy
- Compliance certification claims
- Guaranteed business outcomes
- Blanket warranty/certification
VALID confirms scope-limited verification state under lane rules, not outcome correctness.
Mind Chill Guardians
Human finality for exceptions/appeals only
Conflict-checked independent review
Multi-review thresholds for high-risk lanes
Auditable traceability with minimal disclosure
Ready to ship autonomy safely?
Definition of done: your workflow blocks on status ≠ VALID.
Scope-limited verification. Not a certification.