Verify a governance boundary

Use this procedure before relying on a policy boundary and when you need evidence that Aethis evaluated a particular action, applied the expected policy and recorded what happened. It combines Evaluate policy, Observe or Enforce semantics, the Action Record’s three tabs and the Verify Chain consistency check.

Before you begin

For a pre-deployment check, you need an Agent with its intended Connection and published Policy attached. Confirm the tool definition and meaning first; a changed, frozen or unresolved tool cannot provide a trustworthy boundary result.

For an evidence review, collect the smallest identifiers available: workspace, approximate time, Agent, Connection, resource, approval request ID, correlation ID or Record ID. Do not collect access keys or paste full sensitive arguments into investigation notes.

Decide the question before opening Activity. Common examples are:

• Did policy block the call before anything reached the upstream server?
• Did a reviewer approve this exact action, and was that approval consumed?
• Did the allowed call succeed, fail, or end with an unknown outcome?
• Are the expected record links and integrity metadata present for this scope?

Test the policy boundary safely

Use Evaluate policy on the Agent’s Tools section. It previews a decision for an exact action without executing the tool.

1. Open the Agent, select Tools, and choose the intended tool and Connection.
2. Select Evaluate policy and enter a non-production resource with representative arguments.
3. Test each boundary value and one value on either side.
4. Record the Policy version and expected decision for each case.

For the sample refund policy used in the quickstart, the checks are:

Safe test input	Expected preview
SGD 500	Allowed
SGD 501	Approval required
SGD 1,000	Approval required
SGD 1,001	Blocked

Use your own policy’s units and boundary values outside the sample. An Unresolved preview is not an Allow. Check for a missing or overlapping condition, an unavailable reference, a frozen Connection or unreviewed tool meaning before continuing.

Expected result: every boundary case produces the intended preview from the intended published Policy. The preview does not run the action.

Confirm Observe or Enforce semantics

Next, use representative traffic and check Activity:

• In Observe, Aethis records what policy decided but does not block, hold or modify the call. An observed Block is evidence of the policy result, not evidence that execution was prevented.
• In Enforce, Block stops the call and Require Approval holds it. Confirm the Agent’s mode before relying on either decision to prevent execution.

Observe is useful for comparing the evaluated decision with real traffic before enforcement. For a consequential test, use a non-production resource and an action whose effect is safe and reversible.

Verify the resulting evidence

Find the Action Record

1. Open Activity and switch to Action Records.
2. Filter to the workspace, Agent, Connection and narrow time window.
3. Search by Record ID, correlation ID, action, resource or another known identifier.
4. Open the record and confirm that the Agent, Connection, resource and capability fingerprint describe the action you are investigating.

If no record appears, clear filters one at a time and confirm the client used the Agent’s Aethis endpoint. Calls that bypass Aethis do not produce an Action Record.

Check policy and approval evidence

Open Governance and record:

• the Policy and immutable version
• the Matched rule and decision
• the approval request and single-use approval IDs, when present
• the sequence and timestamps in Record lifecycle

For a Require Approval decision, open the linked approval and compare its action fingerprint with the record. Approve Once only authorizes that exact action and does not execute it. The lifecycle should keep the policy decision, human decision, approval consumption and execution result separate.

Check the outcome

Open Summary and interpret the outcome literally:

Outcome	What it establishes
Blocked, not executed	Policy stopped the action at Aethis; no upstream execution was attempted.
Approval pending	The action is held and has not been executed.
Approved, awaiting execution	A single-use approval exists, but the matching call has not used it.
Execution succeeded	The upstream call completed.
Execution failed	The call failed and Aethis knows the side effect did not happen.
Outcome unknown	Dispatch may have happened, but no definite result was received. Check upstream first.

Never treat Outcome unknown as a safe retry signal. Check the upstream system for the resource or side effect before another attempt.

Check record integrity

1. Open Integrity and inspect the record’s link status, chain value, previous-record reference and retention.
2. Select Open Previous Record when you need to follow the recorded link backward.
3. Return to Activity and select Verify Chain.
4. Choose Current workspace · current filters for a bounded set, or Selected record only when a record is open.
5. Select Run Verification.

Expected result: Aethis reports how many records were checked and whether it found record consistency issues. The check does not change records.

Respond to integrity statuses

Status	Response
Intact	The expected integrity and link metadata is available and the check completed successfully. Continue with policy and outcome review.
Delayed	Wait for expected evidence or link metadata, then run the same scoped check again. Preserve the Record ID if the delay persists.
Degraded	Treat assurance as reduced. Open the record, note which evidence is affected and start an Evidence Integrity investigation.
Gap	An expected event, link or durable result is confirmed missing. Start an investigation and preserve the surrounding record IDs.
Unverified	Run Verify Chain for the selected record or bounded scope. If verification cannot complete, start an investigation.

An Evidence Integrity alert should have an owner and remain Investigating until the underlying record condition is understood. Acknowledge alone does not restore integrity.

Record the result

For an audit note or support case, include:

• workspace and time window
• Record ID and correlation ID
• Agent, Connection and resource
• Policy version, matched rule and decision
• approval request or single-use approval ID, if any
• outcome and integrity status
• verification scope and number of issues reported

Keep credentials and unredacted sensitive arguments out of the note. See Security and data for retention and credential handling.