Model approval is not execution authorization.
Approval and authorization answer different questions. Approval asks whether exact content completed review. Authorization asks whether that content may perform this action on this device and controller now.
Request a Shadow AuditThe stale-approval failure mode
A model may remain approved while a robot configuration changes, an incident triggers revocation, or the requested action falls outside the reviewed workflow. Treating approval as permanent execution permission loses those contextual checks.
Two-stage design
- Store approval against an immutable release content hash.
- Issue an execution permit only while the release remains approved and not revoked.
- Bind the permit to action hash, device, controller configuration, and a short expiry.
- Consume the permit once at the local gateway and record the result.
Example
A picking policy can be approved as an artifact. A permit for robot A with gripper configuration X must not authorize robot B, configuration Y, or a later action. The local check converts that distinction into an enforceable boundary.
Operational boundary
Authorization constrains when approved content can reach a controller. It does not validate task safety, perception quality, collision avoidance, or the physical environment.
Continue the architecture review
Ready to map the release path? Request a Shadow Audit.