promptdojo_

The paper trail — legal review, versions, and adverse-action evidence — step 2 of 8

ch 54 · people studio2/8

The boundary as a state machine

Run it. Five calls, two refusals, and the two refusals are the entire point.

A policy in this studio is always in exactly one of four states: draft, legal_review, approved, published. The TRANSITIONS dict is the boundary, written down: from each state, the only moves that exist. Look at what the topology encodes:

  • draft goes one place: legal_review. There is no arrow from draft to published. Not a discouraged arrow, not an arrow behind a warning dialog — no arrow. The first call tries the shortcut and the machine refuses, which means the shortcut fails the same way at 4:55pm on a Friday as it does in a calm Tuesday review. That's the property memory-based rules never have.
  • legal_review goes two places — forward to approved, or back to draft. That back-arrow is the honest one: legal review that can only say yes isn't review, it's ceremony. Counsel kicks a draft back, the changes happen, it re-enters review. The loop is normal; the machine makes it cheap.
  • approved requires a name. The third call tries to approve with nobody attached and gets refused. by="K. Osei, employment counsel" isn't decoration — it's the review record being created at the moment of approval, because that's the only moment it's guaranteed to be true. "Who approved the monitoring policy?" now has a one-name answer stored on the object itself.
  • published goes nowhere. A published policy doesn't get edited; it gets superseded by a new version that walks the whole path again. That's how version history stays honest — there is no quiet in-place edit that leaves the changelog lying.

Notice how small the enforcement is: one dict, one membership check, one guard clause. The hard part was never the code — it's that most teams keep this boundary in a process doc, where it can be skipped by anyone having a bad week, which eventually includes everyone. Ten lines of Python make it a machine that doesn't have weeks.

The same shape runs your ATS approval chains and your HRIS change workflows, which is worth knowing when a vendor demos "configurable approval flows" — you now know it's a transitions dict with a markup. Next: drills on who signs off, the version log, and the Friday shortcut someone actually ships.

read, then continue.