Trust Artifact Architecture

How does a governed bounded handoff work?

A governed bounded handoff identifies a specific request, the evidence and limits it relies on, the checks required of the receiver, and a linked outcome. The atomic trust unit describes that architectural pattern—not a shared packet format already implemented across the demonstrations.

1. Read the distinct responsibilities before considering how participants could connect.
2. Use the atomic trust unit section to follow the request, evidence, permissions, receiver checks and outcome.
3. Check the evidence and limitations before treating any proposed connection as implemented.

The atomic trust unit: one bounded handoff.

A governed workflow advances through small, inspectable handoffs. Each identifies the request, its supporting evidence, the limits that apply, and what the receiver must check before continuing.

Here, “atomic” means the smallest handoff considered as a unit—not a guarantee that every connected system completes its work together.

Five questions for each handoff

1. What is being requested? A specific action with a defined scope, sender and intended receiver.
2. What supports it? References to the evidence and its recorded version, so later changes can be detected.
3. What rules and permissions apply? Applicable policy, required human review, and any separate, current execution permission.
4. What must the receiver check? That the evidence has not changed and the required conditions and authority remain satisfied.
5. What record remains? A linked result or receipt showing what happened—or why work stopped.

A handoff does not transfer authority automatically

A valid packet is not proof that its source claims are true. Receiving it does not approve the request or authorize execution. The receiving system must enforce its own applicable boundaries; model output and policy evaluation do not replace a person’s required decision.

Missing authority, changed evidence, failed required review, or unavailable policy evaluation must prevent continuation in the proposed integration.

Across a proposed mesh, this pattern would repeat between nodes. One participant’s receipt would not grant another participant permission to act.

This is an architectural pattern, not a common packet format already implemented across the demonstrations. Each example retains its own records, checks and simulation limits. These proposed conditions do not add to G1 evidence or establish a connected runtime.

Questions before you continue