Policy Authority
BeaconGuard separates policy authoring from the authority permitted to govern production. Compliance Playbooks become production authority only after validation, compilation, governance approval, signing, release verification, and explicit activation.
Production authority hierarchy
| Stage | Role |
|---|---|
| Compliance Playbook | Source definition of governed control intent |
| Validation and Compilation | Produces a deterministic compiled representation |
| Governance Approval | Confirms the customer-approved control intent |
| Signed Immutable Release Artifact | Binds release identity, compiled controls, and signing authority |
| Release Verification | Checks signature, integrity, trust, and release requirements |
| Explicit Activation | Selects the verified release permitted to govern the target environment |
| Active Verified Release | The current verified policy authority for runtime authorization |
Action-authorization inputs
Exact-action evaluation can consume normalized deterministic inputs such as:
- Material-action type, target, parameters, and deterministic identity
- Human / service / workload / agent identity
- Delegated-authority chain and constraints
- Tenant and environment
- Workflow and source-system context
- Required approvals
- Freshness and replay state
- MCP/A2A/API invocation context where relevant
- Attributes required by the active policy release
Decision outputs
- ACTION ALLOW — the exact material action satisfies current verified policy and trust requirements; one-time execution authority may be issued.
- ACTION DENY — the exact material action is not authorized; no execution authority is issued.
Review or governance notification may occur after DENY, but review is not a third runtime permission state and does not mutate the original DENY.
Determinism
Given the same Active Verified Release and the same canonical material-action and normalized authorization inputs, the policy evaluator is expected to produce the same deterministic result.
Provenance
Decision evidence should preserve:
- playbook_identity — control lineage
- release_identity — the verified release that governed the decision
- release / manifest integrity identity where applicable
- material-action identity
Failure semantics
Missing, invalid, revoked, inactive, mixed, or unverifiable policy authority fails closed. No draft or unsigned policy material may silently become production authority.