Decionis
Start Now

Layer 3 — The Execution Authority protocol

Deterministic. Contextual. Explainable.

Signals about a proposed action are evaluated against the policy in force at that instant, producing a verdict on which execution is gated. The same signals against the same policy always produce the same verdict.

What is Execution Authority?

Execution Authority determines whether one exact action is permitted to execute now, under the organisation’s policy and required approval. Identity proves who is acting; guardrails assess content and risk; Execution Authority decides whether the resulting action may commit and records the decision as verifiable evidence.

  • Evaluate an exact action against the policy in force.
  • Bind required approval to that action.
  • Check a single-use execution grant before commitment.
  • Keep signed evidence of the decision and observed outcome.
Inspect the authorization and execution sequence

Your identity system, guardrails and downstream application retain their existing responsibilities.

The Protocol — Deterministic. Contextual. Explainable.Four stages left to right. Input signals — user or agent identity, context and data, tools and resources, spend and budget, policies, history and reputation, and environment — enter the Decionis Protocol. Inside, the protocol normalizes context and intent, evaluates policies and rules, runs a deterministic risk and policy engine, and explains the reason and evidence. It emits a verdict: ALLOW (authorized), ESCALATE (needs approval or more info), or BLOCK (high risk or out of policy). The verdict drives an enforcement action: allow, block, require approval, or throttle and limit. Every decision is recorded for audit, learning, and continuous improvement.INPUT SIGNALSUser / Agent IdentityContext & DataTools / ResourcesSpend / BudgetPoliciesHistory & ReputationEnvironmentDECIONIS PROTOCOLNormalizeContext & IntentEvaluatePolicies & RulesRisk & Policy Engine(Deterministic)ExplainReason & EvidenceVERDICTALLOWAuthorizedESCALATENeeds approvalor more infoBLOCKHigh risk orout of policyACTIONSAllowBlockRequire ApprovalThrottle / Limit
Four stages left to right. Input signals — user or agent identity, context and data, tools and resources, spend and budget, policies, history and reputation, and environment — enter the Decionis Protocol. Inside, the protocol normalizes context and intent, evaluates policies and rules, runs a deterministic risk and policy engine, and explains the reason and evidence. It emits a verdict: ALLOW (authorized), ESCALATE (needs approval or more info), or BLOCK (high risk or out of policy). The verdict drives an enforcement action: allow, block, require approval, or throttle and limit. Every decision is recorded for audit, learning, and continuous improvement.
Every decision is recorded for audit, learning, and continuous improvement.

The four stages

Everything the protocol does inside a single call, in order.

Stage 1

Signals

The proposed action plus the evidence around it — actor, amount, counterparty, cost basis, inventory, prior decisions — normalized into one contract regardless of which surface it arrived from.

Stage 2

Policy

The rules in force at that instant, resolved from the policy graph and pinned by version, bundle hash and effective window so the decision is reproducible later.

Stage 3

Verdict

A deterministic ALLOW, ESCALATE or BLOCK — the same signals against the same policy always produce the same verdict.

Stage 4

Action

Execution proceeds, halts, or waits on an approver, and the signed Decision Dossier is written to the ledger either way.

Three verdicts, four actions

The verdict is the judgement. The action is what the surface does about it — which is why one verdict can drive different enforcement on a checkout, an ERP posting, or an agent's tool call.

ALLOW

Authorized

The action is within policy on the evidence presented. It executes, and the dossier records the authority it executed under.

ESCALATE

Needs approval or more info

The action needs authority the requester does not hold, or evidence the request did not carry. It waits for whoever can supply it. When that is a person's approval, Presence, the escalation layer built into Decionis, verifies the approver for this exact action.

BLOCK

High risk or out of policy

The action breaches policy or crosses a risk threshold. It does not execute, and the dossier records which rule stopped it and on what evidence.

Enforcement actions

  • Allow
  • Block
  • Require Approval
  • Throttle / Limit

The decision lifecycle

The protocol is what happens inside one call. The lifecycle is what happens around it — including the signed record that outlives it and feeds the next decision.

The Decision Lifecycle — From intent to accountable execution.Five stages in a closed loop around the Decionis Protocol. One: Detect, an actor wants to act. Two: Evaluate, apply policies, context and rules. Three: Decide, returning allow, escalate, or block. Four: Execute, carry out the authorized action. Five: Record, log, audit, learn and improve — which feeds back into detection. Every step is observable, explainable, and auditable.1. DETECTto act2. EVALUATEApply policies,context & rules3. DECIDEProceed, Hold,or Escalate4. EXECUTECarry out theauthorized action5. RECORDLog, audit, learnand improveDecionisProtocol
Five stages in a closed loop around the Decionis Protocol. One: Detect, an actor wants to act. Two: Evaluate, apply policies, context and rules. Three: Decide, returning allow, escalate, or block. Four: Execute, carry out the authorized action. Five: Record, log, audit, learn and improve — which feeds back into detection. Every step is observable, explainable, and auditable.
Every step is observable, explainable, and auditable.
  1. 1

    Detect

    A high-stakes action is proposed on some surface.

  2. 2

    Evaluate

    Signals are gathered and checked against the policy in force.

  3. 3

    Decide

    A deterministic verdict is issued — allow, escalate, or block.

  4. 4

    Execute

    The action proceeds, waits for authority, or is stopped.

  5. 5

    Record

    A signed Decision Dossier preserves what was decided and why.

Want to see it refuse something? Try to break it in the Sandbox — no account required.

Next — step 3 of 7What to GovernPick the kind of action you want a decision in front of.

Updated · Published by Decionis, Inc. · Contact the team