The Action Authority spine

Every finding HALO acts on travels the same governed path, whether the outcome is "auto-healed", "queued for your approval", or "refused". There is no shortcut around this spine — it is the one execution path in the system.

What each stage guarantees

Stage	What it guarantees
Finding Intelligence	Duplicate and low-value findings are filtered and scored before anything reaches a decision-maker — less noise, fewer repeats.
Agents propose	Agents never execute directly. They can only produce a proposal describing what they want to do and why.
Authority Engine	Every proposal is classified by blast radius and reversibility, then routed by your own autonomy policy. Nothing executes without passing this stage.
Action Gateway	The single write path. Credentials are brokered just-in-time from your own vault, scoped to exactly the approved action.
Proof Engine	"Fixed" means proven, not merely executed — an independent check confirms the underlying condition actually changed.
Flight Recorder	An append-only, tamper-evident record of what happened — and, distinctively, of what HALO deliberately declined to do and why.

Why the shape matters

Orchestration — the wiring that moves a proposal from stage to stage — is commodity. Governance, proof, and the compounding of verified defensive knowledge are the product above it: who may act, what evidence is required before anything is called done, and what gets learned for next time.

Related docs

• Truesec HALO documentation
• Who governs HALO? (trust brief)