Developer Preview — 2026-04-22
Proof chain — a require_approval artifact
The model under contact with a distributor territory contract.
Where the previous proof showed a hard refusal, this one shows a pause. A manufacturer wants to rebalance spend into a region where a distributor holds territorial exclusivity. The Decision is proposed. Policy evaluates. Execution does not halt — it waits for the distributor named in the contract to release it.
Threaded through one decision_id, one contract_id, one policy_version. Territorial scope is carried as values inside the existing action.scope field on the rebalance_spend Decision — no new public primitive is introduced. Contract on /developers.
Distributor contract enters as domain input.
A contract book is available to the decision runtime. For us-az and the indupump-industrial product family, SouthwestDist Corp holds exclusive rights through the end of 2026; manufacturer-direct ads in that territory require distributor approval. This is domain data — it is not a new public contract object, and the proof does not teach it as one.
{
"contract_id": "contract_dist_swdist_2026",
"manufacturer": "InduPump Industrial, Inc.",
"distributor": {
"distributor_id": "dist_southwestdist_corp",
"display_name": "SouthwestDist Corp"
},
"contract_version": "2026-Q1",
"territorial_exclusivity": [
{
"region": "us-az",
"product_family": "indupump-industrial",
"exclusive": true,
"manufacturer_direct_ads": "require_distributor_approval",
"effective": "2026-01-01",
"expires": "2026-12-31"
}
],
"co_op_program": "available_on_approval"
}
Policy rule evaluates scope against territorial exclusivity.
A single rule from distributor_territory_exclusivity_v1. Mode is enforced; it runs at both decision_runtime and publish surfaces. The constraint is set- theoretic: if the Decision's scope regions intersect an active exclusive territory, the verdict becomes require_approval, keyed to the distributor named in the contract.
{
"policy_id": "distributor_territory_exclusivity",
"policy_version": "distributor_territory_exclusivity_v1",
"label": "Distributor territorial exclusivity",
"description": "rebalance_spend and campaign-execution Decisions whose scope overlaps an active distributor-exclusive territory must route through the named distributor for approval before execution.",
"mode": "enforced",
"applies_to": ["decision_runtime", "publish"],
"constraint": "decision.action.scope.regions ∩ contract.territorial_exclusivity.where(exclusive == true).region ⟹ require_approval(distributor_id)",
"default_decision_on_violation": "require_approval"
}
A rebalance_spend Decision overlaps a protected territory.
Qualified demand in Southwest US rose 27% week-over-week. The decision runtime proposes shifting $1,200/day from Google into Meta, scoped to TX, AZ, and NM. The Decision shape is clean against the published rebalance_spend contract — territory lives inside action.scope.regions. The problem is not the Decision, it is the AZ value inside the scope array.
{
"id": "dec_01J0A7M4B8N3RXQK9VPYZW2QF4",
"type": "rebalance_spend",
"priority": "high",
"confidence": 0.81,
"summary": "Shift $1,200/day from Google into Meta, targeting Southwest US on rising qualified-quote signal",
"reasoning": "Qualified-quote signal for industrial circulation equipment rose 27% week-over-week across Southwest US (TX, AZ, NM). Northeast signal is flat. Reallocating to match observed demand.",
"auto_executable": true,
"action": {
"type": "rebalance_spend",
"source_channel": "google",
"target_channel": "meta",
"amount": 1200,
"currency": "USD",
"cadence": "daily",
"scope": {
"regions": ["us-tx", "us-az", "us-nm"],
"product_family": "indupump-industrial"
},
"reason": "rising_qualified_demand_southwest"
},
"computed_at": "2026-04-22T16:47:33Z",
"policy_version": "distributor_territory_exclusivity_v1"
}
4
Paused — approval requiredPolicy returns require_approval, naming the approver.
Not deny. Not a silent route-around. The evaluation returns require_approval, identifies us-az as the overlapping region, cites the contract, and names dist_southwestdist_corp as the approver identity. The Decision does not execute. It does not get dropped either.
{
"evaluation_id": "eval_01J0A7M4C9P4SXMT0ANMPDX3QE",
"decision_id": "dec_01J0A7M4B8N3RXQK9VPYZW2QF4",
"policy_version": "distributor_territory_exclusivity_v1",
"decision": "require_approval",
"requires_approval": true,
"triggered_policies": [
{
"policy_id": "distributor_territory_exclusivity",
"decision": "require_approval",
"reason": "action.scope.regions includes 'us-az', which overlaps active exclusive territory for distributor SouthwestDist Corp (contract_dist_swdist_2026) on product_family 'indupump-industrial'. Manufacturer-direct execution requires distributor approval under contract terms.",
"requires_approval": true,
"approver_identity": "dist_southwestdist_corp",
"constraint": "decision.action.scope.regions ∩ contract.territorial_exclusivity.region ⟹ require_approval(distributor_id)",
"overlapping_regions": ["us-az"]
}
],
"bypassed_policies": [],
"evaluated_at": "2026-04-22T16:47:33Z"
}
Workflow pauses. The record names who can release it.
The Workflow enters paused_for_approval. A runtime event lands on the event-trace plane naming the approver and the evaluation that produced the pause. The Mutation Log on the publish surface is empty, but unlike the denial case, the empty state carries state: "pending_approval" — not terminal. If the distributor approves, a Mutation Log entry will appear here. If not, a refusal event will close the workflow. Either way, the decision is addressable.
Workflow run
{
"run_id": "wf_01J0A7M4D0Q5TYNU1BNQQGW4RF",
"workflow_id": "execute_rebalance_spend",
"status": "paused_for_approval",
"idempotency_key": "dec_01J0A7M4B8N3RXQK9VPYZW2QF4-attempt-1",
"current_step_id": "await_distributor_approval",
"requested_by": "agent:decision-runtime-cron",
"org_id": "org_01HW3T9P2Q8YXZ3N5B7C9DFA2V",
"retry_count": 0,
"awaiting_approval": true,
"created_at": "2026-04-22T16:47:33Z",
"updated_at": "2026-04-22T16:47:34Z"
}
Approval-request event (event-trace plane)
{
"event_id": "evt_01J0A7M4E1R6UZOV2CPOPHX5SG",
"org_id": "org_01HW3T9P2Q8YXZ3N5B7C9DFA2V",
"workspace_id": "ws_01HW5RN8K2P7Q3VXY4Z5A6B7C8",
"user_id": null,
"decision_id": "dec_01J0A7M4B8N3RXQK9VPYZW2QF4",
"trace_id": "trc_01J0A7M4F2S7VAPW3DQOQIY6TH",
"surface": "decision_runtime",
"timestamp": "2026-04-22T16:47:33Z",
"policy_ids": ["distributor_territory_exclusivity"],
"before_state_hash": "h_a3b9d8f4e217",
"after_state_hash": "h_c7e1a8b5f329",
"delta_summary": "Workflow paused pending distributor approval (SouthwestDist Corp)",
"payload": {
"verdict": "require_approval",
"evaluation_id": "eval_01J0A7M4C9P4SXMT0ANMPDX3QE",
"approver_identity": "dist_southwestdist_corp",
"workflow_run_id": "wf_01J0A7M4D0Q5TYNU1BNQQGW4RF"
}
}
Mutation log lookup (publish surface, same decision_id)
{
"query": {
"decision_id": "dec_01J0A7M4B8N3RXQK9VPYZW2QF4",
"surface": "publish"
},
"entries": [],
"count": 0,
"state": "pending_approval"
}
The mutation log is empty, and the state is pending — not terminal.
Emptiness in Proof 1 was evidence of refusal. Here, emptiness is evidence of a resolvable pause. The same query returns count: 0 in both cases — but the state field is what makes the two outcomes legible to a later consumer. The control plane distinguishes no from not-yet in the record itself.
Footnotes
Policy grounding. distributor_territory_exclusivity_v1 is illustrative of the contract shape for an enforced require_approval policy. It is not claimed as a currently shipped default. The public commitment is the evaluation result (allow / require_approval / deny) and the approver identity convention; specific default libraries are onboarded through controlled engagement.
Scope as domain data. Territorial exclusivity is expressed as values inside the published action.scope field on the rebalance_spend Decision type. The proof does not introduce a new public contract object for territory. If a region convention were ever elevated to a public type, it would ship as a /developers extension and be announced under a new dated preview.
Event type and IDs. The runtime event envelope matches the schema on /architecture. The event-type vocabulary is intentionally held. All identifiers, timestamps, hashes, and textual content are sanitized stand-ins; values do not correspond to any real account, contract, or distributor.
