Definition
The rule that policy is a state of the running system rather than an input consumed at deployment. A policy record has a version, assumptions, an expiry, and a current status that other objects can read and react to.
It matters because policy held as a document cannot take part in control. Only policy held as state lets an assumption going stale change an authority grant without anyone remembering to look.
Structural
Tests that show it is in place
- Policy status is queryable at runtime by the component that enforces authorization.
- A policy change produces a state transition somewhere, or the change is recorded as non-binding.
- No enforcement path depends on a human reading a policy document at the right moment.
Evidence to keep
- Artifact: A runtime policy status endpoint or table that authorization checks read.
- Behavior: An authorization refused because the policy backing it was in a lapsed status.
- Metric: Share of enforceable policies with a machine-readable current status.
References
- Laws for engineering delegated intelligence · Doctrine