Governed Workflow State Graph

Where it fits

Four decisions this is shaped for.

For a workflow where an organisation must later answer: what was decided, what evidence was in scope, which policy applied, who approved it, and whether a retry could repeat an effect.

What it guarantees

Enforced by shape, not by convention.

Each of these is enforced by the shape of the model rather than by convention, and each is covered by a test that attacks it.

Approvals bind, or they do not apply.

The approval is addressed by its content — instance, transition, policy version, input digest, evidence digest set. Change the evidence and the old approval is not found rather than silently reused.

A repeat is not a re-run.

The same idempotency key returns the original record and produces no second intent. A repeat with changed material inputs is rejected outright.

Uncertainty is declared, not absorbed.

A blocking or unresolved question routes to a human. A signed exception cannot override it.

An escalation can be resolved — only by a human.

Agents are refused. Terminal states are shut to everyone.

Documents stay outside the record.

The durable event shape has no field that can hold source text. What is retained is references, digests, bounded classifications, and caller-supplied labels.

Five steps

A bounded evaluation walkthrough

1. 01Choose one decision. For example: approve a claim exception, approve a supplier change, or authorize an agent to prepare—not execute—an action.
2. 02Declare the boundary. Required evidence references, policy version, approval role, allowed operation, stop conditions, and retention constraints.
3. 03Run the workflow twice. The normal path, and one adverse path such as changed evidence, expired approval, denied policy, or an interrupted action.
4. 04Review the evidence. Hash-chained transitions, reason codes, approval binding, uncertainty state, and recovery classification.
5. 05Decide what would be required next. A production design needs the customer’s identity, storage, key-management, retention, integration, and control-owner decisions. This prototype does not supply them.

Discuss a bounded evaluation for a customer-shaped workflow. No source documents, provider credentials, payment authority, or live effects are needed for the initial review.

Machine-readable evidence

See it for yourself

Known limits

What this is not, yet

No external audit, no certification, and no production deployment. The reference store is in-memory. Digests are accepted from the caller, so the engine cannot detect a caller that supplies a digest for bytes it does not hold. The event chain is tamper-evident but unsigned. Connecting a real disbursement is deliberately future work, not an omission.