Software acts. The community stays accountable.
The architecture · Structure 5 / 5
The hardest architectural question of this decade is not how capable software can be. It is what a community can still hold accountable once software acts without being told each step. This page states the structure Unifyhub requires before that is allowed.
Four questions every action must answer
1. Who is acting?
A delegated actor holds its own identity and appears in the record as itself. Acting under a borrowed human account or a shared administrative credential destroys attribution permanently, so it is treated as a defect rather than a convenience.
2. On whose authority?
Authority is delegated explicitly, for a stated scope and a stated period, by someone who held it. The chain from a human decision to a machine action is recorded and can be walked backwards.
3. Was it permitted?
The same policy decision point answers for people and for software. There is no faster path for automation, because a faster path is exactly where the exceptions accumulate.
4. What is the evidence?
What was requested, what was done, what was checked, and what a reviewer accepted. The record shows why the system believed the action was allowed, which is the part that matters when the question is asked months later.
Confirmation is proportional
Not every action deserves the same friction, and pretending otherwise produces approval fatigue, which is a security failure with good intentions.
Low consequence, reversible
Proceed and record.
High consequence or hard to reverse
Require explicit confirmation from an authority that can carry it, and record the confirmation alongside the action.
Outside the stated scope
Refuse and surface, rather than asking for forgiveness with a completed change attached.
Revocation is a designed operation
Granting authority is easy to build and easy to reason about. Withdrawing it is neither, which is why it is designed first: what stops immediately, what is already in flight, what must be reconciled, and how the community can see that it took effect. A system where revocation is improvised is a system where delegation was never really governed.
The standing constraint
Capability that cannot carry identity, delegation, evidence, and revocation stays outside the community's record. This will sometimes mean declining a capability that competitors ship. That is the trade, and stating it plainly is the point, because a boundary that is only honored when convenient is not a boundary.