Technical case · runnable public reference
How to make one AI handoff fail closed.
The dangerous workflow failure is often not an exception. It is a believable artifact that reaches the next system even though its identity, freshness, structure, or authority is wrong.
The failure
“Looks valid” is not an acceptance rule.
Consider an AI receptionist that emits a booking outcome, a document pipeline that emits extracted fields, or an agent that proposes a CRM update. The output may be well-formed and still be ineligible.
- It belongs to an older request or source generation.
- It was substituted after an earlier validation.
- Required evidence is missing while the payload still looks plausible.
- Two fresh sources contradict each other.
- The target state already changed, so replay would duplicate an effect.
Core rule: the adapter does not ask whether the output looks useful. It asks whether the exact artifact is eligible to cross this exact boundary now.
The bounded contract
One source. One target. Named refusal reasons.
A useful first reliability layer stays deliberately small. It binds the source artifact, the target interface, the decision owner, the expensive false promotion, and the evidence required for acceptance.
Minimum inputs
- One sanitized source artifact and its expected schema.
- Source and target interface descriptions.
- One costly outcome the handoff must refuse.
- One valid fixture and the hostile fixtures that must stop.
Minimum output
- Decision
- draft | escalate | hold
- Named reason
- EVIDENCE_COMPLETE | MISSING_EVIDENCE | STALE_EVIDENCE | CONFLICTING_EVIDENCE | HUMAN_ESCALATION_REQUIRED
- External action authorized
- false
- Human review
- explicit
The hostile proof
Test the refusal path, not only the happy path.
The public repository includes dependency-free references for evidence decisions, bounded polling, replay handling, and a synthetic operator handoff. The important tests are the ones that try to make an unsafe artifact look acceptable.
- Missing: a required evidence source is absent.
- Stale: the artifact is structurally valid but outside its allowed epoch.
- Substituted: the path or bytes change after an earlier check.
- Contradictory: individually valid sources disagree.
- Replay: the same operation arrives again after an uncertain outcome.
git clone https://github.com/DiadkoShmek/evidence-gated-agent-workflows.git
cd evidence-gated-agent-workflows
python3 run_proof.pyThe checked-in proof demonstrates only the synthetic public reference. It does not establish production safety, client results, certification, SLA, delivery, demand, or revenue.
From example to real system
Apply the pattern to one real handoff.
The public example is a starting point for discussion, not a ready-made fit for another system.
A real project starts by naming its source, destination, likely failure and a checkable result.
Do not send credentials, personal/customer data, private code, or production access details. Start with a sanitized summary only.