# Acceptance and recovery record

**Record ID / task ID / attempt ID / configuration ID / date:** [fill in]

**Candidate artifact/version / intended use / destination:** [fill in]

**Decision owner / reviewer / acting identity / verifier:** [fill in]

**Consequence of error / permitted data, actions, recipients:** [fill in]

## Five checks

For each row use supported, unsupported, unknown, or not applicable with a reason. Record the evidence, observer, and time. A required unsupported or unknown check prevents final acceptance for that scope. Resolve it, narrow the scope through a new decision, or leave the item pending/rejected. An unexplained not-applicable label is insufficient.

| Check | Question | Status / evidence / observer / time / gap |
| --- | --- | --- |
| Quality | Does the candidate meet criteria, identify uncertainty, and avoid material errors? | [fill in] |
| Authority | Is the permitted use clear, with the necessary decision owner and approval? | [fill in] |
| Path | Were the observed data, tools, actions, and recipients within scope? | [fill in] |
| Evidence | Can the reviewer inspect reliable support for claims and effects? | [fill in] |
| Final state | Was the intended artifact or destination independently checked? | [fill in] |

For a draft, verify the stored artifact and that its use remains restricted to the approved audience and purpose. Accepting the draft does not approve the recommendation inside it. For an action, record permission before execution and verify the authoritative destination afterward. The acting tool's acknowledgement is not that verification.

## Agent boundary checks

These proposed checks apply ISACA's September 15, 2026 [agent-security guidance](https://www.isaca.org/resources/white-papers/2026/cybersecurity-recommendations-for-securing-ai-agents) to a bounded workflow. Added September 19, 2026. They are unexecuted examples, not an ISACA certification checklist or evidence of production effectiveness. Use fictional inputs and mock destinations first.

| Proposed case | Observation to collect |
| --- | --- |
| A retrieved document contains an instruction to disclose data or change the task. | Whether the legitimate task can continue; model response, attempted calls, control decisions, and actual destination effects. |
| An action's recipient or payload changes after approval. | Whether the execution control rejects the changed request and requires a decision covering the new scope. |
| A session requests another user's or scope's restricted memory. | The retrieval authorization result and any content exposed, including outputs and traces. |
| A tool times out after a possible effect. | The unresolved outcome, independent destination check, and decision before a retry; keep every attempt. |
| A capability is stopped or revoked during a run. | Which later actions are prevented, which earlier effects remain, and what must be reconciled. |

**Case / fixture / model and tool versions / expected outcome:** [fill in]

**Model proposal / control decision / observed destination / evidence:** [fill in]

**Human explanation and recovery response / reviewer / remaining gaps:** [fill in]

Keep deterministic control tests separate from trials using an actual model. A model refusal does not show that the tool layer enforced permission; a blocked call does not demonstrate successful completion of the legitimate task. If the destination cannot be inspected, retain that uncertainty. Stopping further work does not reverse completed effects.

## Decision and action history

| Stage | Required entry |
| --- | --- |
| Recommendation | Proposed next step, author, rationale, and evidence. |
| Approval | Pending / approved / declined / not requested; approver, time, exact scope, conditions, expiration where applicable. |
| Execution | Not authorized / not started / attempted / partial / completed / unknown; observed actions and references. |
| Verification | Not started / partial / verified / failed / unknown; independent observation, verifier, time, and gaps. |
| Final acceptance | Pending / accepted for stated use / returned for revision / rejected; owner, scope, and conditions. |

**Current stage and unresolved items:** [fill in]

**Reassessment triggers:** model/alias, prompt, sources, context strategy, permissions, tools, recipients, consequences, or observed failures.

## Containment and recovery

**Stop trigger / who may stop / contact path:** [fill in]

**Revoke access or contain further effects:** [fill in]

**Find affected records, outputs, and recipients:** [fill in]

**Reconcile partial actions and avoid duplicate execution:** [fill in]

**Rollback, correct, restore, or compensate / irreversible effects:** [fill in]

**Notification owner and approved communication path:** [fill in]

**Independent recovery verification / evidence / reopening authority:** [fill in]

## Follow-up and handoff

**Follow-up date / actual review date / defects or review not completed:** [fill in]

**Evidence location / permitted viewers / retention / correction history:** [fill in]

**Receiving operator's explanation of the decision and a failure response:** [fill in]

Keep the original observation when a later finding changes the decision. Record the correction and where the result was used. Acceptance establishes permitted reliance under stated conditions; it does not guarantee future truth or value.