{ "schema": "org-writing@v1", "slug": "readiness-is-not-authorization", "kg": { "id": "org:writing:readiness-is-not-authorization", "type": "brick", "graph": "/kg.json" }, "title": "Readiness is not authorization", "subtitle": "A thing being finished is not permission to send it", "abstract": "What collapses when a system treats completed work as its own release approval, and the posture that keeps the last step a human one. The canonical treatment of the readiness-authorization split.", "kind": "brick", "topics": [ "Boundaries" ], "courseMemberships": [ { "course": "org:courses:boundary", "topic": "Boundaries", "wall": "org:walls:engineering", "position": 2, "total": 5 } ], "publishedAt": "2026-08-03T00:00:00.000Z", "updatedAt": "2026-08-20T00:00:00.000Z", "version": 2, "guidelinesVersion": 16, "brief": { "problem": { "text": "Pipelines that verify their own output tend to treat the last green check as clearance, so the act of completing work silently becomes the act of releasing it and nobody notices the two were ever separate.", "claims": [ "remain separate from authorization to send" ] }, "mechanism": { "text": "Readiness is a property of the artifact and authorization is a choice within a relationship, so a system deriving the second from the first has converted finishing into consent and removed the moment at which a person could decline.", "claims": [ "no second-person authorization was required before a live alert was transmitted" ] }, "move": { "text": "Build the pipeline with no send path at all, so releasing is a separate act by a named person rather than the last step of a build that has been going well.", "claims": [] } }, "sources": [ { "repo": "mnstry-tenants", "path": "an internal quality-gate ruling on packaging (document path withheld, tenant-identifying)" }, { "repo": "mnstry-atelier", "path": "docs/atelier-runtime.md" } ], "canonicalPath": "/writing/readiness-is-not-authorization/", "body": "A package passes every gate. The archives regenerate byte for byte from the named source, the visual proof renders from the generated files rather than from retained references, the unpacked contents scan clean, and the last check goes green. Everything the process was built to establish has been established. The obvious next step is to send it, and the obvious next step is the mistake.\n\nAn internal quality-gate ruling closes its packaging section with a single sentence that does more work than the checklist above it. Artifact readiness must remain separate from authorization to send. It is easy to read that as procedural fussiness, one more sign-off in a document already full of them. It is the opposite. It is the line that keeps a verification system from becoming a dispatch system without anyone having chosen to build one.\n\nThe mechanism is that readiness is a property of the artifact while authorization is a choice within a relationship. A pipeline deriving the second from the first has converted finishing into consent and removed the moment at which a person could have declined.\n\nThe strongest form of the separation is not a confirmation step. The MNSTRY authoring runtime states its default posture as a list of absences: no telemetry, no external network egress, no runtime mutation, and no browser apply endpoint. It describes support bundles as dry runs with no send path. Not a send behind a prompt, not a send requiring a flag. No send path. A confirmation dialog is a behavioral guard sitting in front of a capability that exists, and it can fail one distracted operator at a time. A missing send path has no failure rate because there is nothing there to fail. The structural absence carries the safety claim.\n\nThe cost of collapsing readiness and authorization became visible outside software delivery. At eight in the morning on 13 January 2018, an employee at the Hawaii Emergency Management Agency working through a routine drill selected an alert and transmitted it, and every phone in the state received a warning of an inbound ballistic missile with the instruction that this was not a drill. It took thirty-eight minutes for a correction to reach the public. The subsequent federal investigation found no rogue actor and no software defect. It found that the live template and the drill template were offered from the same menu, and that no second person was required to authorize a live alert before it went out. The system had one question where it needed two. Is the message ready, and separately, does this go to a million people. Among the corrective actions adopted afterwards was the obvious one, which is that a live alert now requires a second person to authorize it.\n\nThe authority boundary appears here in an ordinary workflow. A pipeline that sends has acted on the world. It may still be a tool, and it became an actor in the event as soon as it changed what people received. The failure is not a metaphysical crossing. The system treated readiness as permission and made an external choice nobody authorized. The companion case, \"Consent that fails CI,\" examines the permission-side collapse in which consent recorded once becomes standing clearance for flows nobody examined.\n\nKeeping readiness and authorization apart preserves a human choice at the point where an artifact could leave the build and enter a relationship. The build can remain automatic. Sending begins only when a named person chooses the moment and the recipient.", "apparatus": { "note": "The human-facing essay is deliberately practical; this apparatus carries the full references, evidence-graded claims, article-local concepts, and research context behind it. Canonical concept definitions come from the concept registry.", "references": [ { "id": "org:references:readiness-is-not-authorization:r01", "author": "Held privately (internal studio documentation, deidentified)", "work": "An internal quality-gate ruling on packaging, whose closing requirement is that artifact readiness remain separate from authorization to send", "year": 2026, "relevance": "The primary artifact. The sentence is already generic and is cited as a ruling rather than by document, because the surrounding gate document is tenant-identifying. It is the shortest statement of the split the corpus has." }, { "id": "org:references:readiness-is-not-authorization:r02", "author": "MNSTRY Atelier", "work": "The runtime document, safety posture", "year": 2026, "relevance": "The structural form of the same split. The default posture is stated as absences, and support bundles are dry runs with no send path, which is the difference between a disabled capability and an absent one." }, { "id": "org:references:readiness-is-not-authorization:r03", "author": "Federal Communications Commission, Public Safety and Homeland Security Bureau", "work": "Report on the false ballistic missile alert transmitted by the Hawaii Emergency Management Agency", "year": 2018, "relevance": "The external anchor. The investigation found an interface offering the live and drill templates from one menu with no second-person authorization step, and the corrective actions included requiring a second person to authorize a live alert." }, { "id": "org:references:readiness-is-not-authorization:r04", "author": "MNSTRY (this corpus)", "work": "'The agency threshold' (the parent essay)", "year": 2026, "relevance": "The frame. A pipeline that sends has acted on the world; its readiness does not supply authority for that action." }, { "id": "org:references:readiness-is-not-authorization:r05", "author": "MNSTRY (this corpus)", "work": "'Consent that fails CI' (the companion brick)", "year": 2026, "relevance": "The same collapse read from the permission side, where a stored agreement becomes standing clearance for flows nobody examined. Cited for the pairing, not re-argued." } ], "claims": [ { "id": "org:claims:readiness-is-not-authorization:c01", "claim": "An internal quality-gate ruling in our own studio documentation requires that artifact readiness remain separate from authorization to send.", "basis": "The gate document read directly on 2026-08-03. The sentence is generic on its face and is quoted without its surrounding context, which is tenant-identifying and withheld.", "confidence": "verified", "sources": [] }, { "id": "org:claims:readiness-is-not-authorization:c02", "claim": "The Atelier runtime declares its default posture as a set of absences including no telemetry, no external network egress, no runtime mutation, and no browser apply endpoint, and specifies support-bundle handling as dry runs with no send path.", "basis": "The runtime document's safety posture and package responsibilities, read directly on 2026-08-03.", "confidence": "verified", "sources": [] }, { "id": "org:claims:readiness-is-not-authorization:c03", "claim": "On 13 January 2018 the Hawaii Emergency Management Agency transmitted a live ballistic missile alert to the public during a routine drill, and a correction reached the public thirty-eight minutes later.", "basis": "The FCC bureau report of January 2018 and the state's own after-action account; the timings are the published ones.", "confidence": "verified", "sources": [] }, { "id": "org:claims:readiness-is-not-authorization:c04", "claim": "The Federal Communications Commission's investigation found that the live alert template and the drill template were selectable from the same menu and that no second-person authorization was required before a live alert was transmitted, and a two-person authorization requirement for live alerts was among the corrective actions adopted.", "basis": "The bureau's report and the agency's subsequent procedural changes. The report attributes the event to process and interface design rather than to a software defect.", "confidence": "verified", "sources": [] } ], "concepts": [ { "id": "org:concepts:readiness-authorization-split", "name": "The readiness-authorization split", "definition": "Readiness is a property of an artifact, established by verification. Authorization is a decision about a relationship, made by a person about a recipient and a moment. A system that derives the second from the first has converted completing work into consenting to release it, and has deleted the point at which anyone could decline. The two are therefore kept apart by construction, and the strongest form of the separation is not a confirmation step but a pipeline with no send path at all, since a prompt is a behavioral guard in front of a capability that exists and an absent path has nothing to fail.", "provenance": "canonical" } ], "researchContext": "SCRUB applied. The primary source is internal studio documentation held\noutside this corpus, and the ruling it contains is cited as a ruling. No\ntenant name, client name, studio identifier, product surface, repository\npath, branch, or commit appears in the prose, the claims, or the sources\npath, which records the character of the document rather than its location.\nThe sentence quoted is generic on its face, which is why it can travel at\nall.\n\nThe brick's contribution is naming the collapse as a collapse and locating\nthe strongest repair in absence rather than in confirmation. The distinction\nbetween a send behind a prompt and a missing send path is the corpus's own\nstructural-over-behavioral argument arriving at the last step of a build, and\nit is credited rather than re-derived. The consent brick owns the same\ncollapse on the permission side and is cited for the pairing only.\n\nGrading note: the Hawaii claims are graded verified and are load-bearing in\nthe brick, so the framing matters. The report found no rogue actor and no\nsoftware defect, and the brick is careful to say so, because the case is\nfrequently retold as an operator error story and told that way it argues the\nopposite of what the evidence supports.\n\nBoundary with the parent essay: \"The agency threshold\" separates action from\nautonomy and authority. This brick owns the authority failure in an ordinary\ndelivery pipeline: the pipeline acts by sending, but readiness cannot supply\npermission for that action. Tool and actor are allowed to overlap." }, "contract": "https://mnstry.org/contracts/org/org-writing.v1.schema.json", "releaseHash": "87798e4d161d00a4fdfa0c8fd9b7f3eb210c715219175f479826b2a2c2d32fd2", "versions": [ { "version": 2, "cutAt": "2026-08-20", "note": "Founder-approved agency-threshold semantic migration", "visibility": "published", "path": "/writing/readiness-is-not-authorization/", "contentHash": "sha256:274235cfec13c600", "releaseHash": "87798e4d161d00a4fdfa0c8fd9b7f3eb210c715219175f479826b2a2c2d32fd2" }, { "version": 1, "cutAt": "2026-08-03", "note": "Initial publication, boundary wave", "visibility": "published", "path": "/writing/readiness-is-not-authorization/v/1/", "contentHash": "sha256:f724f358aec56021" } ] }