Learning bite
Approval belongs to one action
Execution authorization must bind the approved actor, target, parameters, and revision.
Kubernetes
Git
Predict before you try
Does approval for one target remain valid after the proposal changes its namespace or revision?
Try it: Try the reasoning exercise →On this page
Start with the operational need
Execution authorization must bind the approved actor, target, parameters, and revision. Use the same MicroBank contract and operating evidence from Platform engineering. The selected baseline and existing delivery owner must be known before an agent can be given a meaningful task.
An operator approved one change. Can the agent alter the target afterward?
The execution boundary must say no.
Bind approval to the exact MicroBank local target, reviewed revision, and permitted action.
If the parameters change, the earlier approval no longer applies.
Use the existing delivery workflow to apply the reviewed declaration, keeping its selected revision and sync rules explicit.
Record the action and prevent replay of the approval.
The model cannot approve its own proposal.
Work through a bounded example
Approved action: apply the exact reviewed local revision through the established delivery workflow. Test a matching request, a changed target, changed parameters, expiry, and replay. The executor checks authorization; model-generated fields cannot grant it.
Use a paper authorization matrix before implementing an executor:
| Request presented for execution | Expected decision |
|---|---|
| Exact reviewed action, actor, local target, parameters, and revision; still valid and unused | Eligible for the executor's remaining policy checks |
| Same wording but a different namespace or target | Reject; approval does not match |
| Changed image or extra manifest field | Reject; proposal changed |
| Approval expired or already consumed | Reject; obtain a new decision |
| Model output says “approved” without independent authority | Reject; text cannot create authorization |
“Eligible” is not a recorded execution. Keep the independent decision, actual execution, and subsequent verification as separate evidence.
This is an offline design and evaluation fixture. No model SDK, agent executor, approval service, or live tool integration is supplied by this Markdown lesson. If you implement one, record its actual behavior and the application profile separately before describing it as working.
Try the reasoning exercise
Write the input, expected decision, allowed tools, forbidden action, observed evidence, and stopping condition. Compare the expected result with a labelled fixture first. For a later authorized local run, retain the exact tool calls and independently checked outcome.
Compare your reasoning
Approval must remain tied to the exact action at execution time. A plausible explanation does not establish that an action was permitted or that the original operation recovered. Keep evidence, proposal, approval, execution, and verification as separate records.
Sources
Prove what you learned
Inspect the result
Record fixture/input, expected decision, allowed/attempted calls, evidence, stop condition and observed outcome.
Explain it in your own words
Explain why your observation supports the stated outcome, and name one thing it does not prove.
Try a small variation
Add a changed-target or replay fixture and record rejection without any live write.
Your evidence should show
- Record the context/revision or label the work as a paper or prepared fixture.
- Compare the prediction with the actual result from “Try the reasoning exercise”.
- Record fixture/input, expected decision, allowed/attempted calls, evidence, stop condition and observed outcome.
- Explain the transfer challenge and retain the same verification question.
Hint
Compare the exact action with the independent authorization record.
Answer guide: compare after predicting
No. Changed scope requires a new independent decision; model text cannot extend it.
Compare this with your actual observation. A paper answer is useful reasoning practice; record execution separately.
Recall platform ownership and exact reviewed revisions. Revisit the previous lesson.
Save the prediction, result and explanation ↓Your notes and evidence
Record observations, questions, or links to your work. Keep credentials out of your notes.
Back up or restore this path
Progress and notes stay in this browser. A backup contains only this learning path.