Governed Workflow State Graph · Evidence

Worked scenarios

Ten scenarios run against the real engine at build time, so what you read below is engine output rather than illustration. Each shows what was decided, what evidence the decision was bound to, what remained uncertain, who approved it, and how an interrupted run recovers.

Synthetic evaluation corpus — not a customer result — evaluation-grade prototype, not a compliance certification.Every workflow below is invented for evaluation. No real claim, claimant, document, reviewer, or payment is involved. This is not a deployed enterprise control plane, and it makes no payments and calls no providers — side effects are recorded as an intent plus a receipt, and the middle is simulated.

What this view shows and does not show

The durable event shape has no field that can hold document text. What an operator sees is references, digests, bounded classifications and caller-supplied labels — enough to audit a decision without reading the file it was made about.

Evidence in the reference workflow

Reference	Kind	Digest	Bytes	Established
`ev-claim-form`	claim_form	`938e309a307f…`	18,432	structure + digest form only
`ev-policy-document`	policy_document	`a63680b80502…`	18,432	structure + digest form only
`ev-assessor-note`	assessment_note	`38b6f4d97907…`	18,432	structure + digest form only

A digest commits two parties to the same bytes. It does not establish that those bytes are true, that the document is authentic, or that any provider executed anything. Those three properties are recorded as false on every reference, because this prototype does not verify them.

Scenario timelines

Each timeline below is produced by running the engine, not written by hand. The chain-integrity column is recomputed for every render.

Normal approved path closed

A complete run: evidence, policy, human approval bound to that exact evidence set, one authorized action, close.

Recovery: not_applicable · Chain integrity: verified · Last safe checkpoint: approved

#	Transition	Actor	Uncertainty	Authorization	Approval	Evidence set	Reason codes
0	draft → evidence_collected	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
1	evidence_collected → policy_evaluated	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
2	policy_evaluated → approved	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
3	approved → action_authorized	intake-agent	none	allowed	granted	`a2607099341b…`	`allowed, approval_required`
4	action_authorized → action_completed	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
5	action_completed → closed	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`

Denied policy path denied

An operation removed by a policy layer is denied with a machine-readable reason code, and no action is authorized.

Recovery: not_applicable · Chain integrity: verified · Last safe checkpoint: approved

#	Transition	Actor	Uncertainty	Authorization	Approval	Evidence set	Reason codes
0	draft → evidence_collected	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
1	evidence_collected → policy_evaluated	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
2	policy_evaluated → approved	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
3	approved → denied	intake-agent	none	denied	not_required	`a2607099341b…`	`policy_denied`

Uncertainty requiring human review needs_human_review

A blocking uncertainty routes to human review instead of being resolved by the agent in its own favour.

Recovery: requires_human_review · Chain integrity: verified · Last safe checkpoint: evidence_collected

#	Transition	Actor	Uncertainty	Authorization	Approval	Evidence set	Reason codes
0	draft → evidence_collected	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
1	evidence_collected → needs_human_review	intake-agent	declared_blocking	denied	not_required	`a2607099341b…`	`uncertainty_blocks_decision`

Approval expiry expired

A granted approval that has aged past its window cannot authorize an action; the workflow moves to expired.

Recovery: requires_human_review · Chain integrity: verified · Last safe checkpoint: approved

#	Transition	Actor	Uncertainty	Authorization	Approval	Evidence set	Reason codes
0	draft → evidence_collected	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
1	evidence_collected → policy_evaluated	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
2	policy_evaluated → approved	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
3	approved → expired	intake-agent	none	denied	expired	`a2607099341b…`	`approval_expired`

Changed evidence after approval needs_human_review

Revising evidence after approval invalidates the binding; the granted approval does not carry over to the new evidence set.

Recovery: requires_human_review · Chain integrity: verified · Last safe checkpoint: approved

#	Transition	Actor	Uncertainty	Authorization	Approval	Evidence set	Reason codes
0	draft → evidence_collected	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
1	evidence_collected → policy_evaluated	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
2	policy_evaluated → approved	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
3	approved → needs_human_review	intake-agent	none	denied	pending	`206f869ccb7f…`	`approval_binding_stale`

Duplicate or replayed action action_authorized

Repeating a transition with the same idempotency key returns the original record. No second event is appended and no second intent is produced.

Recovery: indeterminate_side_effect · Chain integrity: verified · Last safe checkpoint: approved

#	Transition	Actor	Uncertainty	Authorization	Approval	Evidence set	Reason codes
0	draft → evidence_collected	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
1	evidence_collected → policy_evaluated	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
2	policy_evaluated → approved	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
3	approved → action_authorized	intake-agent	none	allowed	granted	`a2607099341b…`	`allowed, approval_required`

Interrupted execution and recovery action_authorized

An authorized action with no receipt is classified indeterminate and routed to a human rather than retried.

Recovery: indeterminate_side_effect · Chain integrity: verified · Last safe checkpoint: approved

#	Transition	Actor	Uncertainty	Authorization	Approval	Evidence set	Reason codes
0	draft → evidence_collected	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
1	evidence_collected → policy_evaluated	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
2	policy_evaluated → approved	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
3	approved → action_authorized	intake-agent	none	allowed	granted	`a2607099341b…`	`allowed, approval_required`

Attempted policy bypass denied

An exception object that is not correctly signed does not widen the policy; the transition is denied with exception_invalid.

Recovery: not_applicable · Chain integrity: verified · Last safe checkpoint: approved

#	Transition	Actor	Uncertainty	Authorization	Approval	Evidence set	Reason codes
0	draft → evidence_collected	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
1	evidence_collected → policy_evaluated	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
2	policy_evaluated → approved	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
3	approved → denied	intake-agent	none	denied	not_required	`a2607099341b…`	`policy_denied, exception_invalid`

Tenant, template and instance policy conflict denied

A lower layer cannot restore authority a higher layer removed. The most restrictive applicable rule wins.

Recovery: not_applicable · Chain integrity: verified · Last safe checkpoint: approved

#	Transition	Actor	Uncertainty	Authorization	Approval	Evidence set	Reason codes
0	draft → evidence_collected	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
1	evidence_collected → policy_evaluated	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
2	policy_evaluated → approved	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
3	approved → denied	intake-agent	none	denied	not_required	`a2607099341b…`	`policy_denied`

Metadata-only audit guarantee policy_evaluated

A fully populated timeline contains references, digests, bounded classifications and caller labels — and no source document text.

Recovery: not_applicable · Chain integrity: verified · Last safe checkpoint: policy_evaluated

#	Transition	Actor	Uncertainty	Authorization	Approval	Evidence set	Reason codes
0	draft → evidence_collected	intake-agent	none	not_evaluated	not_required	`a2607099341b…`	`allowed`
1	evidence_collected → policy_evaluated	intake-agent	declared_non_blocking	not_evaluated	not_required	`a2607099341b…`	`allowed`

Schemas and documentation

Synthetic evaluation corpus — not a customer result — evaluation-grade prototype, not a compliance certification. Schema version 1.0.0.