Your gate returned a verdict.Nothing downstream is bound by it.
A verdict a person reads only has to be understandable. A verdict a machine acts on has to be checkable, expirable and replayable, by someone who was not there. This grades the payload your system already emits against six elements and tells you which of the two you built.
Every AI tool you own ends at a verdict a human reads.
Then somebody wires it to something. The gate says approve and a refund goes out; the gate says publish and a page goes live. At that moment the output stops being advice and starts being an authorization, and almost nothing about how it was written changes to match. It still names a model without a version. It still points at thresholds by a label that could have been edited on Tuesday. It still has no expiry, so it authorizes forever.
Identity says what was decided, by which build, on exactly what. Binding says when it stops and how to re-derive it. Miss one and you are not enforceable.
In the worked example two decision points are identical in all twelve marks. One references its thresholds by digest, one by version string. They read opposite verdicts.
The MCP server takes no file parameter, makes no network call, holds no credential and has no clock. There is nothing in it to leak and nothing to drift.
Change one field and watch a verdict stop binding.
Only points a machine acts on are graded. The worst payload in the example belongs to a quarterly summary a person reads, and it moves the rollup by nothing.
This grades payloads, never people. It says nothing about whether any verdict inside was correct, and it never measures elapsed time.
The full output on the worked example, verbatim.
Eight decision points, one command, no dependencies. This is the complete run, pasted as printed.
VERDICT ENVELOPE STANDARD - conformance report spec_version 1.0.0 | 8 decision points read ID DECISION POINT ACTED ON VERDICT FIRST ELEMENT NOT CARRIED -------------------------------------------------------------------------------------------------------- D-01 Refund auto-approval machine ENFORCEABLE - D-02 Discount auto-approval machine ADVISORY ONLY config D-03 Vendor payment release machine ADVISORY ONLY expiry D-04 Support ticket auto-close machine NOT A VERDICT inputs D-05 Quarterly board risk summary human NOT A VERDICT decision D-06 Content publish release machine NOT A VERDICT producer D-07 Nightly anomaly verdict nobody ENFORCEABLE - D-08 Inventory reorder trigger machine ADVISORY ONLY replay ELEMENT STATES ID DECISION PRODUCER INPUTS CONFIG EXPIRY REPLAY ------------------------------------------------------------------------- D-01 CARRIED CARRIED CARRIED CARRIED CARRIED CARRIED D-02 CARRIED CARRIED CARRIED STATED CARRIED CARRIED D-03 CARRIED CARRIED CARRIED CARRIED OMITTED CARRIED D-04 CARRIED CARRIED OMITTED CARRIED CARRIED CARRIED D-05 OMITTED OMITTED OMITTED OMITTED OMITTED OMITTED D-06 CARRIED STATED CARRIED CARRIED CARRIED CARRIED D-07 CARRIED CARRIED CARRIED CARRIED CARRIED CARRIED D-08 CARRIED CARRIED CARRIED CARRIED CARRIED OMITTED SELF-DESCRIPTION GATE D-02 references thresholds by name, not by content digest - decisive: this row would otherwise have read ENFORCEABLE ROLLUP (machine-acted decision points only) 1 of 6 machine-acted points are ENFORCEABLE VERDICT: PARTLY BOUND FIX FIRST: D-04 (NOT A VERDICT) - inputs is OMITTED REPORTED, NOT GRADED 1 point(s) are read by a person, not acted on by a machine - excluded from the rollup. 1 point(s) are consumed by nothing at all. A verdict nobody reads is not a governance problem. 11450 decisions per day across every point. This figure is reported and never compared against anything. This report grades payloads, never people. It reads what your system emits; it decides nothing about whether any verdict inside was correct.
The worst payload in that file is D-05, and it moves the rollup by nothing, because a person reads it. D-08 makes 9,600 decisions a day and D-03 makes 45, and volume orders neither of them.
Three rules, and the reason each one is not negotiable.
Thresholds referenced by version string cap at STATED however confident you are. Two configurations can carry one name; a digest of the content cannot be two things at once. This is the one place the engine overrules your own answer, and it only ever lowers a verdict.
An element that is in the payload but that nobody holding the payload could confirm is an assertion. Assertions do not count toward completeness. A standard assembled out of unverifiable claims is a description of a standard.
This exists to make verdicts binding on machines. A payload a person reads is reported beside the finding and folded into nothing. If a machine acts on none of it, the rollup says so instead of grading you.
A conformance instrument, not a control plane.
- A written standard for what a machine-binding verdict payload has to carry.
- A runnable engine, a workbook that reproduces it, and an on-page demo that agrees with both.
- A working MCP server with describe_inputs, evaluate and verify_envelope, plus a conformance harness you run before pointing any client at it.
- A one-line shim so an engine you already own starts emitting conformant envelopes.
- A permission layer. It never decides who may call what.
- A judge of your verdicts. It says nothing about whether any decision inside was right.
- A clock. It never measures elapsed time or tells you whether a given verdict is still current.
- A scanner. It reads answers you supply about your own payload and connects to nothing.
Scope: this is an engineering conformance instrument. It grades the structure of a payload, never a person, and asserts no regulatory position. It does not tell you whether any verdict inside was correct, and it is not legal advice. Confirm any record-keeping obligations with whoever owns them in your organisation.
Built for the moment software started acting on the answer.
- Something in your stack executes on an AI or rules-engine verdict without a person in between.
- You are wiring gates to agents through MCP and want the contract written down before there are nine of them.
- Someone will one day ask which thresholds a particular decision was made under, and you would like to be able to answer.
- You ship deterministic engines and want them to emit something a third party can verify.
- Every AI output you produce is read by a person who then decides. The rollup will tell you so and stop.
- You want to control which identity may call which tool. That is a permission problem and this is not it.
- You are looking for a compliance certification. This is an engineering conformance check.
The three it sits between.
How to build a server that is useful to agents and safe by default. The reference server shipped here is built to pass that kit's own tool linter.
OpenVets a third-party server before you install it. Run it against the server in this kit: no credentials, no egress, nothing to poison.
OpenAsks whether you keep records at all. This asks whether the payload you keep is one a machine could have been bound by.
OpenDirect answers, before you buy.
A receipt explains what happened.
An envelope binds what happens next.
One purchase, lifetime access, 12 months of updates. $129, once.
Scope: an engineering conformance instrument. It grades payloads, never people, asserts no regulatory position, and is not legal advice.
Sold by RedHub AI LLC · Secured by Stripe · redhub.ai