Governance · Lesson 01 of 03
Policies, refusals, and canaries
Policies define what is permitted. Refusals are the enforced rejections. Canaries prove that refusals actually fire when they should.
Learning objectives
- Write a policy that refuses a named task for agents
- Describe what a refusal canary tests
- Explain why a canary is not a policy
Prerequisites
Governance policy constrains declared execution; it does not silently repair or authorize it. Ota evaluates applicable rules over the complete selected closure and preserves deny, review, allow, unknown-selector, and hard-pin findings as typed evidence.
Decision precedence is fail-closed
Applicable workflow and task rules accumulate deterministically. Deny takes precedence over review, and review takes precedence over allow. Review is still a refusal on every execution surface; it is not an authorization shortcut.
ota policy review --jsonota run --dry-run --json testHard identity pins stay unconditional
A missing, unreadable, or mismatched expected_identity always refuses governed execution. A policy on_insufficient posture cannot weaken an explicit contract pin into review or allow. Receipts must preserve the same pre-execution observation set used by admission.
Canonical terminology
Evidence boundary for this lesson
Establishes
- The worked examples establish the lesson's canonical Ota distinctions for its stated scope.
Does not establish
- Reading the lesson does not validate a repository, execute its tasks, or establish organizational acceptance.
Knowledge check
Does a review policy decision authorize execution?
No. Review is an inspectable refusal posture. An explicit supported authority path is required before execution may begin.