# Policy exception approval workflow blueprint

Version: 1.0
Canonical job: `/solutions/customer-support/policy-exception-approval`

## States

`requested -> preparing -> awaiting_approval -> approved|rejected|needs_evidence|redirected|expired -> executing -> reconciled|execution_exception`

Terminal states: `rejected`, `redirected`, `expired`, `reconciled`. `needs_evidence` returns to `preparing` with a new proposal version.

## Data contract

```yaml
case_id: string
proposal_version: integer
customer_id: string
policy: {id: string, version: string, clause: string, normal_outcome: string}
request: {exception_type: string, scope: object, reason: string, expires_at: datetime}
evidence: [{source_id: string, url: string, observed_at: datetime, hash: string}]
authority: {approver_id: string, rule_id: string, limit: object, checked_at: datetime}
decision: {outcome: enum, reason: string, decided_by: string, decided_at: datetime} | null
effect: {idempotency_key: string, destination_ref: string, status: enum} | null
```

## Steps and actors

1. **Trigger:** receive exception request; key `exception:{case_id}:v{proposal_version}`.
2. **Code:** resolve policy and calculate normal outcome.
3. **Code:** validate evidence, identity and schema.
4. **AI (bounded):** produce source-cited summary; no recommendation or authority selection.
5. **Code:** evaluate authority rules and conflicts.
6. **Human:** approve, reject, request evidence or redirect with reason and expiry.
7. **Code:** revalidate decision scope and current preconditions.
8. **Code:** execute with idempotency key and reconcile destination.
9. **Human:** own any ambiguous, harmful or consequential execution exception.

## Retry, permissions, and rollback

- Retry read-only retrieval within a capped exponential-backoff budget.
- Never retry an ambiguous side effect before destination reconciliation.
- The summarizer has read-only access to the evidence manifest.
- The approval service can write decisions but cannot execute effects.
- The executor receives only the approved, unexpired scope.
- Where rollback is not complete, define a named compensating action and human owner.

## Acceptance tests

1. Missing policy clause cannot enter `awaiting_approval`.
2. Out-of-range authority routes to `redirected`.
3. Expired approval cannot execute.
4. A changed proposal requires a new decision.
5. Two delivery attempts create one destination effect.
6. Timeout after success reconciles rather than repeats.
7. Model summary contains no fact without an evidence reference.
8. Every terminal state has an owner, timestamp and reason.