One workflow, two different graphs
The coordination graph carries tasks, working state and artifacts between specialists. The authority graph carries permission to advance a workflow or change an external resource. Conflating the graphs allows an apparently successful subtask to become an unintended production decision. This L3 applied pattern has two interfaces: L6 supplies independent identity and policy enforcement; L7 supplies outcome and recovery evidence.
Planning contract: each step identifies its owner, objective, versioned inputs, permitted operations, completion predicate, budget, deadline and required evidence. A step may be split or reassigned, but delegation cannot enlarge its authority. “Done” means evidence is ready for qualification, not that a protected effect has occurred.
Delegate with a bounded envelope
A delegation record needs a parent run ID, task and worker IDs, applicable policy revision, allowed resources, capabilities, expiry, retry budget, expected output schema, artifact digest and a cancellation path. A worker receiving an unfamiliar tool or a higher-privilege request must halt and seek a new policy decision rather than inferring authorization from tool visibility.
- Lease: assign each step a renewable time-bound lease, with explicit owner and fencing version.
- Replay: checkpoint durable state; assume an activity may be retried after partial completion.
- Idempotency: bind externally effectful calls to an operation key and reconcile the actual target state before retrying.
- Provenance: retain immutable references to evidence artifacts and worker versions, even if working summaries change.
- Expiry: invalidate the delegation when the task, principal, context classification or requested effect changes materially.
Microsoft's Durable Task documentation describes persisted execution history, event sourcing and replay, while its programming-model guidance explicitly distinguishes deterministic orchestration from activities that can execute more than once. These are implementation facts about Durable Task, not proof that a particular AI-agent workflow is secure.
Preserve disagreements through synthesis
Imagine three specialists reviewing a proposed infrastructure change. One reports passing deployment tests; another finds a missing access review; the third identifies a documentation mismatch. The synthesizer should produce a typed decision packet with all three claims, source links, dissent, uncertainty, and outstanding conditions. A majority vote does not substitute for a risk acceptance record or a change approval.
Before a consequential action, an independent gate checks the accountable principal, exact artifact digest, target environment, operation arguments, policy version, approval scope and freshness of evidence. The gate returns permit, deny or hold with a reason. The execution service then records the effect and a separate observation checks the target state. The approver is bound to the actual operation—not just to a narrative summary.
Practical failure tests
- Two workers claim the same step: only the current fencing token can progress.
- A worker times out after a remote side effect: reconcile the target before any retry.
- Output artifacts disagree: preserve both, escalate unresolved differences.
- An approval is for a prior artifact: reject the changed operation.
- A verifier is unavailable: place the transition on hold rather than passing by default.
- An operation partially succeeds: keep the run incomplete and record recovery evidence.
Engineering decision: treat durable orchestration as an execution substrate and authorization as a separate, fail-closed capability. Prefer one accountable decision owner, but distribute bounded cognition and evidence gathering when the workload supports it. Test the simpler single-worker alternative on equal tasks and disclose total cost, latency and failure rate.
Evidence boundary: NIST AI RMF Govern provides governance considerations, not an endorsement of this particular state machine. The controls and test cases above are proposed design requirements, not claims of a deployed or certified production implementation.
Open questions: how will decision conflicts be resolved on a deadline; where are immutable evidence and approval records stored; which actions qualify for automated low-consequence progression; and who confirms recovery after partial effects?
Related reading: Central Authority, Distributed Cognition and Promotion Is a Control.
Privacy Notice: With your consent, this website uses Google Analytics to understand aggregate visits and content usage. Analytics is optional and is not used for advertising or cross-site profiling. Some content and images may be generated or modified with the assistance of AI; every AI-assisted item is reviewed and manually edited by a human before publication. Full Privacy Policy ·