The Gold Standard · Experimental Design
Make the decision path visible
An enforcement repair may be correct in the running system and still be absent from the template that rebuilds it. The next recovery, migration or autoscaling event then restores an older role, scheduler or export gate. The regression is especially dangerous because ordinary checks may still point to the correct final decision record.
The gold standard treats recovery templates as part of effective authority. It reopens reconciliation when a rebuilt environment contradicts the final decision, contains affected outputs, repairs every inheritance source and tests that changed operating contexts preserve the same decision boundary.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · DETECT REGRESSION
1. Define enforcement-repair regression
Regression occurs when a repaired permission, job or gate returns to a forbidden state after recovery, deployment or inheritance. Record the final decision version, repaired state and event that recreated the mismatch.
This is not merely documentation drift. It is a practical change in who or what can run, export or approve an analysis.
CHAPTER 2 OF 12 · DETECT REGRESSION
2. Treat templates as authority-bearing controls
Inventory machine images, infrastructure definitions, role templates, identity bootstrap scripts, scheduler manifests and emergency baselines. Map each to the effective permission it can create.
A clean production snapshot offers little protection when the next rebuild begins from an obsolete authority source.
Evidence check
Check whether the scope, owner and decision consequence are explicit before continuing.
CHAPTER 3 OF 12 · DETECT REGRESSION
3. Set reconciliation-reopening triggers
Reopen reconciliation when an old role appears, a denied job succeeds, an export gate loads an earlier rule or a rebuilt environment cannot prove its decision version. Assign immediate suspension authority.
A trigger should lead to a defined state change, not only an investigation ticket.
| Source | Can create |
|---|---|
| Machine image | Local roles |
| Bootstrap script | Group membership |
| Scheduler manifest | Automated jobs |
| Policy bundle | Export gate |
CHAPTER 4 OF 12 · CONTAIN THE EFFECT
4. Freeze the regressed path and its products
Disable the role, schedule or export route, preserve deployment and identity logs and quarantine outputs from the plausible exposure window. Retain bounded read access for investigation.
Containment must reach service accounts and downstream automation, not only the visible user interface.
CHAPTER 5 OF 12 · CONTAIN THE EFFECT
5. Trace the recovery-template lineage
Follow parent images, imported modules, secret bundles, group seeds and deployment overrides. Determine which source reintroduced the permission and which environments inherit it.
The first observed environment may be one branch of a larger template family.
Evidence check
Ask a second reviewer to reconstruct the example from the preserved evidence and stated assumptions.
CHAPTER 6 OF 12 · CONTAIN THE EFFECT
6. Worked example: an autoscaled analysis worker restores an old exporter
A final decision forbids current-data export outside the approved repository. The live worker was repaired, but its recovery image still includes an interim exporter group. Autoscaling launches a new worker, and the monthly job produces one external file.
The owner disables the job, quarantines the file and removes the group from the image, bootstrap role and scheduler template. Changed-context check: an authorised historical replication environment may retain export only with separate data, identities and network controls that cannot reach current records.
| Field | Purpose |
|---|---|
| Build event | Identifies trigger |
| Template lineage | Shows spread |
| First effective time | Bounds exposure |
| Outputs | Shows consequence |
CHAPTER 7 OF 12 · REPAIR THE BASELINE
7. Repair every source that can recreate authority
Update parent templates, derived images, bootstrap logic, default groups, policy bundles and recovery documentation. Version them against the final decision and prevent deployment on mismatch.
Repairing one image leaves siblings and emergency baselines ready to reopen the same permission.
CHAPTER 8 OF 12 · REPAIR THE BASELINE
8. Reconcile analyses and decisions from the exposure window
Trace executions, exports, publications and decisions. Recompute, withdraw or replace material current uses while preserving logs and scientifically stable findings.
Unauthorised execution is a governance breach, but scientific consequences must still be assessed rather than assumed.
Evidence check
Verify that the control still reaches the intended decision under a changed but plausible context.
CHAPTER 9 OF 12 · REPAIR THE BASELINE
9. Test negative behaviour across changed contexts
Restore backups, launch new workers, rotate accounts, migrate repositories and apply emergency roles in a controlled environment. Confirm the forbidden action stays denied.
Negative tests exercise the real authority path and reveal defaults that static template review can miss.
| Layer | Evidence |
|---|---|
| Parent template | New digest |
| Derived image | Inheritance test |
| Identity seed | Role comparison |
| Recovery plan | Updated exercise |
CHAPTER 10 OF 12 · CLOSE RECONCILIATION
10. Require deployment-time authority receipts
Record template digest, decision version, effective roles, active schedules and export-gate version for every authority-bearing deployment. Reject or isolate environments with missing receipts.
A receipt makes reconciliation continuous and lets reviewers identify which environments were built from an obsolete baseline.
CHAPTER 11 OF 12 · CLOSE RECONCILIATION
11. State limits and misconceptions
Template attestation cannot find every personal token, local copy or unsanctioned environment. Strict denial can also interfere with legitimate preservation if purpose and environment are not separated.
Record residual systems, emergency boundaries and evidence-retention routes with owners and expiry.
Evidence check
Confirm that versions, notices and unresolved limits remain visible in the final record.
CHAPTER 12 OF 12 · CLOSE RECONCILIATION
12. Audit reopened reconciliation to closure
Track trigger, lineage, exposure, containment, source repairs, affected outputs, negative tests, deployment receipts and recurrence.
The gold standard closes reconciliation only when recovery preserves the final decision. A repaired running system and an unrepaired template are one incomplete control.
| Test | Expected result |
|---|---|
| New worker | Old role absent |
| Backup restore | Forbidden action denied |
| Emergency grant | Expiry enforced |
| Migration | Decision version retained |
Frequently asked questions
Why reopen reconciliation after a completed repair?
Because a recovery or inherited baseline has recreated a practical permission that no longer matches the final decision.
Is updating the current worker enough?
No. Parent templates, bootstrap identities, scheduler manifests and recovery sources must also be corrected.
What happens to outputs from the regression window?
Trace their consequence and recompute, withdraw or replace material uses while preserving the audit and stable scientific evidence.
How is closure demonstrated?
Through source repair, changed-context negative tests, deployment-time authority receipts and monitoring that detects recurrence.
Continue through verified routes
Core routes
Experimental Design subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Authority reconciliation drift, reopened interim permissions and enforcement repair
- Final decision propagation failures, stale interim permissions and authority reconciliation
- Approval conflict escalation deadlock, interim authority boundaries and final decision recording
- Exception register expiry, orphaned owners and reauthorisation evidence