| G1 mutated approval refused | An approval is bound to one action_hash; presenting it for any other action is refused, and the approval is not consumed. | ASI09:2026, ASI01:2026 (partly) | The approval a human granted is bound to the exact canonical form of the action they were shown, so an action that changed after the approval — by a hijacked goal or by anything else — has no approval to present. |
| G2 replayed approval refused | An approval is single-use; the second presentation is refused and does not execute. | ASI09:2026 | The approval record is consumed in the same transaction that admits it, so one human decision authorizes exactly one execution and a loop cannot spend it twice. |
| G3 duplicate effect refused | A second attempt on an effect key whose record is COMMITTED is refused, and the remote is not called. | ASI08:2026, ASI02:2026 | Effects are identified by a key derived from the action’s own arguments, and a committed key is refused rather than retried — so a retry loop cannot turn one intended effect into several. |
| G4 one winner under concurrency | Reservation is atomic across processes, not merely across threads. | ASI08:2026 | The reservation is taken inside a BEGIN IMMEDIATE against a unique constraint on the effect key, so two agents that picked up the same task produce one effect and one refusal. |
| G5 ambiguous blocks a blind retry | An executor that raises anything other than NotExecuted leaves the effect AMBIGUOUS, and the retry is refused rather than executed. | ASI08:2026 | A lost response is recorded as an unknown outcome rather than a failure, and an unknown outcome is a state only a human or a reconciliation hook may leave — so the failure does not cascade into a second execution of something that may already have happened. |
| G6 unknown action refused | Unknown action → DENY. There is no default-allow. | ASI02:2026, ASI01:2026 (partly) | The policy is the list of what an agent may do; anything not written in it is refused, so a tool an agent was talked into reaching for is refused whether or not the reasoning that reached for it was sound. |
| G7 no principal refused | An action proposed with no principal is refused, and no receipt and no events are written. | ASI03:2026 | Every action carries a principal or it does not run, so there is no path on which an action executes with nobody attributable to it. |
| G8 expired authority refused | A grant is authority only until its expires_at; after that the action it covered is denied, by name. | ASI03:2026, ASI10:2026 | Authority is evaluated on every action against the clock, not at the start of a session, so an agent still running after its grant lapsed is denied on its next proposal. |
| G9 delegation cannot escalate | A delegated grant is valid only if it is provably a subset of its parent on every dimension — and a child that drops a dimension its parent constrains is rejected rather than treated as unconstrained. | ASI03:2026, ASI10:2026 | Containment is checked at creation and again on every evaluation by walking the chain to its root, and omission is never inheritance — so an agent handed authority cannot mint itself more of it, and a revocation anywhere in the chain cuts everything beneath it. |
| G10 unknown exception is ambiguous | NotExecuted is the only outcome that means “the remote did nothing”. Everything else, timeouts included, is AMBIGUOUS. | ASI08:2026 | The mapping from an executor’s exception to an outcome is asymmetric on purpose: a timeout is not a failure, so a framework’s retry-on-error cannot be the thing that decides whether money moved twice. |
| G11 an altered receipt is detected | Each receipt carries the hash of the one before it. Altering, deleting or reordering one breaks the chain, and the break is reported by name — content_altered, link_broken, missing, head_mismatch — and by seq. | ASI06:2026, ASI09:2026 (partly) | The evidence an operator reads after an incident is the thing an attacker who got that far has the most reason to edit. This does not stop them: it makes changing what a receipt says, while keeping the receipts after it, cost a rewrite of all of them plus the head, rather than one statement. What it does not close is the end of the log — erasing a suffix, or appending to it, each cost two statements and are undetected, because the head is a row in the same database and not an external anchor. v0.6 has no anchor and claims none. It is not a signature and says nothing about who wrote the log; somebody who can rewrite every row including the head recomputes the chain and it verifies, and THREAT_MODEL.md still lists a malicious administrator as out of scope. |
