Who could authorize what?
Bind actor identity, delegated authority, policy decision and action scope instead of assuming permission transfers across actions or routes.
Assurance service
Assure the boundary between permission and consequence.
DDCAL examines whether consequential AI or software actions were properly authorized, evidenced, bounded and executed under the conditions that were actually present.
What was actually known?
Assess prerequisites, observed state, freshness, conflicts and evidence-channel adequacy at the action boundary.
What crossed the boundary?
Separate authorization, dispatch, observed execution and downstream consequence so one does not silently stand in for another.
Typical assurance targets
- AI agents with tool or infrastructure authority
- approval-to-execution workflows
- software deployment and transition controls
- physical-device or operational actions
- high-consequence automated decisions
Decision discipline
DDCAL records uncertainty explicitly. A procedurally compliant actor does not prove the evidence mechanism or infrastructure was adequate, and a dispatched action does not by itself establish its final consequence.
Candidate status: controlled real-client release remains subject to QMS recovery/re-establishment and applicable scope, software and public-claims approvals.