EAF-10 — Unrecorded Decision

The execution may even be admissible — but no durable record of that decision will exist.

WARN no admissibility record produced or stored

Definition

No durable, inspectable record of the admissibility decision is produced or stored. The mutation happens; the decision evaporates. Whatever gate logic ran leaves nothing that can be inspected, compared across time, or cited in review.

This class closes the ontology because it attacks the system itself: a boundary whose decisions leave no records cannot be shown to exist. Six months later, an unrecorded allow and no decision at all are indistinguishable.

How it appears

Approvals living in chat scrollback and meeting memory.
Gate logic embedded in scripts that emit only an exit code.
Agent deliberation discarded with the context window at the end of the session.
Audit trails reconstructed after incidents instead of read during them.

Across actors

Agent

An agent framework checks permissions internally before each tool call, then throws the check away. After an incident, the operator can prove what the agent did — never what was decided about it.

CI / pipeline

A deployment gate evaluates six conditions and returns a boolean. Which condition nearly failed last Tuesday is unknowable.

Human operator

A production change is approved verbally on a bridge call during an outage. Everyone remembers it differently.

Why it defeats admissibility

Records are what make the boundary exist over time rather than per-run. They allow decisions to be compared (“why was this allowed in March and denied in May?”), audited without archaeology, and improved deliberately. Denials are the cheapest audit findings an organization will ever produce — but only if they are kept.

Remediation

Emit a JExec Record for every boundary decision — including allows, which are the majority and the baseline.
Store records append-only, outside the executing system’s own write path.
Reference record identifiers from deploy logs and change systems; retain denials indefinitely.

In the JExec Record

Primarily affects: decision, timestamp. The JExec Protocol maps EAF-10 to the consequences above; JExec Check detects it deterministically and links back to this page.