The design contract
Safety-critical authority and plant control remain with the qualified systems and people responsible for them.
Scope and objects
- Classification and purpose
- Delegated roles
- Approval gates
- Audit and decision records
Workflow principles
Apply the appropriate access boundary at retrieval and action time.
Separate conflicting approval responsibilities.
Retain evidence for review, correction, and recovery.
Applying the contract
For a specific engagement, identify the authoritative records, source versions, identity and access context, allowed state transitions, and receiving outcome. Document the approval and the evidence needed to accept the action.
Failure and recovery
Preserve the request identity and source intent. A timeout or partial handoff should leave a visible unresolved state until the authoritative outcome can be reconciled. Recovery follows the defined action contract and the responsible owner.
Acceptance evidence
The delivery record should connect the agreed baseline, representative inputs, permissions, relevant failure cases, observed outcomes, and operating responsibilities. A change in scope or environment requires review of the applicable contract.