Human authority
Red Zone actions require explicit human approval. Agents cannot mint, return, replay, or approve their own authority token.
Security
Trust boundaries remain outside the delivery agent
The harness fails closed when source identity, artifact integrity, credential separation, review independence, or human authority cannot be established.
Boundary controls
Source identity
Evidence binds the commissioned repository, revision, and route. Work from a different source identity cannot satisfy the run.
Credential separation
Bridge, reviewer, and execution credentials remain distinct. Child processes do not receive finish-line credentials.
Artifact root
Evidence files must remain within the commissioned artifact root. Symlink escapes, mutation, and deletion fail closed.
Independent review
The delivery identity cannot be every reviewer. Review applicability cannot be silently downgraded.
External authority
Authoritative assurance depends on protected execution, trusted signers, provider state, or another commissioned authority outside the delivery agent.
Restricted-residue boundary
Public release surfaces can be scanned without printing the private restricted-value list. The authoritative workflow must run on a protected default branch with self-review prevention, an independent required reviewer, and pinned unattended identity. Without those controls, the result is operator-supervised evidence, not release authority.
Consequence boundary
A test pass does not authorize deployment, traffic movement, secret rotation, data migration, app-store promotion, destructive cleanup, failover, or residual-risk acceptance. Those actions remain human decisions.