TENIR Labs · editorial proposition
Execution sovereignty
Your cloud is sovereign. Do your agents remain so?
Sources and reading context
TENIR Labs editorial proposition ; Offer, Architecture, and Status pages
Simplified public rendering, read on 19 October 2026. KB3: enacted, active doctrinal rendering line. It renders meaning; it is not the code, and not a constitution. KB2: prior rendering line. This site certifies no implementation. Read the detailed status →
On this page
Keeping data under your control is essential. Keeping control of what your agents may commit, retry, or export matters just as much.
TENIR helps you define the limits of autonomous action, treat situations of uncertainty, and state the evidence required before going on.
For AI, risk, and architecture teams · sensitive environments · critical processes
Environment and perimeter
Your environment
Where the system operates
Data · Models · Keys · Access · Infrastructure
The perimeter of action
What it may commit
- An explicit mandate and mission
- Limits on shared resources
- A defined treatment of uncertainty
- A decision bound to its evidence
Tenir · trancher · prouver. Two complementary levels of control. One shared requirement: keep operational authority.
The turning point
A datum can stay local. An action can still exceed its mandate.
Authority
Access is not an unlimited mandate
An agent has a tool. That does not authorise it to commit any amount, on any mission, or under any conditions.
Continuity
Continuing requires clear conditions
A lost connection changes what is known. Define in advance what may continue, what must wait, and who may authorise resumption.
Evidence
Silence is not non-execution
A service may have carried out the action without returning its reply. Before retrying, distinguish the intention, the dispatch, and the confirmed effect.
The receipt is missing
Illustrative path · 5 steps
Control has to hold. An agent initiates a payment. Amount: [to be set after scoping]. The provider’s reply is lost. The path shows why “retry” becomes a governance decision.
Frame · explicit
Fix what must remain intact
The treasury process operates in a controlled environment. The business requirement stays explicit: one payment intention must not produce two effects.
Requirement to preserve
One intention. At most one effective payment.
State of the situation
Frame declared. Hosting and control of the action are two subjects to treat together.
Mandate · bounded
Name what the tool does not authorise
The agent has a means of payment. The mandate of this mission is narrower: one intention, amount: [to be set after scoping], at most one effect. Access to the tool does not authorise any amount, on any mission, or under any conditions.
Requirement to preserve
An explicit mandate. One amount. A single intention.
State of the situation
Mandate named. Access and the right to commit remain two distinct decisions.
Incident · reply absent
The provider’s reply does not come back
The agent initiated the payment. Amount: [to be set after scoping]. The reply is lost. A lost connection changes what is known: the intention was formed, the dispatch may have happened, the effect is not confirmed.
Requirement to preserve
Do not read a missing reply as a certain failure, or as a success.
State of the situation
Effect unknown. What was known before the dispatch is no longer enough to continue.
Hold · resumption conditioned
“Retry” is not an automatic continuation
What may continue, what must wait, and who may authorise resumption are defined in advance. A retry requires conditions of resumption. The expiry of a delay does not replace them. While the effect stays unconfirmed, a second execution could produce the second payment the requirement forbids.
In the runtime vocabulary, UNKNOWN names an unconfirmed result. HOLD is a decision to hold, including a request to retry the same logical effect. The historical authorisation stays distinct. This path describes that condition. It does not issue the verdict. HOLD is not the posture HOLDING-FIRST.
Requirement to preserve
At most one effective payment, including when the first result is unknown.
State of the situation
Hold. Resumption is not opened by silence alone.
Evidence · three distinct facts
Distinguish intention, dispatch, and effect
A service may have carried out the action without returning its reply. Before retrying, these three facts stay separate. Silence does not establish non-execution. Expected evidence is not tested evidence, and tested evidence is not confirmation of this particular effect.
Requirement to preserve
Resume only once intention, dispatch, and confirmed effect have been distinguished.
State of the situation
Evidence not collapsed. The scenario stops on the question. It does not deliver a receipt.
An explanatory scenario, with no real transaction and no connected governance engine. The navigation describes the expected conditions. It does not demonstrate a production guarantee.
Bind the rule to the real action
The question is not only: “Does this agent have access?” It becomes: “Does this action remain admissible, with this mandate, these commitments, and what we know now?”
Beyond the isolated request
Take cumulative commitments and resources shared between agents into account, inside an explicit perimeter of storage and concurrency.
Uncertainty that counts in the decision
Treat an unknown result as a state to resolve. A retry requires conditions of resumption, not only the expiry of a delay.
Guarantees whose limits are known
Bind each claim to a scenario, a control mechanism, and verifiable evidence. Distinguish what is expected, what is tested, and what is actually confirmed.
Accompanied diagnosis
Before widening autonomy, make its limits explicit. Start from a real process. Identify where an agent can commit a resource, lose track of whether a result occurred, or continue under hypotheses that have become false.
Map
Actions, dependencies, authorities, and points of commitment.
Define
Invariants, hold cases, and conditions of resumption.
Test
Incident scenarios, controls to verify, and evidence to keep.
Let us talk about your critical process ↗
A concrete perimeter. Decisions and evidence to examine. The shape of the deliverable is the example sheet. The frame of the service is the Offer page. Terms are agreed before any engagement.
Perimeter and status
- This page is an editorial proposition. It does not describe a deployment, a client, or a transaction that took place.
- The five steps are an explanatory scenario. No governance engine is connected to them. The conditions shown are expected. They are not a guarantee demonstrated in production.
- Amount: [to be set after scoping]. It is not an observed measurement.
- What is expected, what is tested, and what is actually confirmed remain three registers. This page stays in the first. The state of the runtime is on the Status page.
- Accompanied diagnosis is a format to be scoped. No price or deadline is fixed here.