> For the complete documentation index, see [llms.txt](https://dsg-3.gitbook.io/dsg-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dsg-3.gitbook.io/dsg-docs/cinema-proof-agent/governance-and-execution.md).

# Governance and Execution

Exact-plan authorization, capability resolution, Observe/Enforce behavior, execution recording, and verification.

## One rule before execution

Cinema does not block work merely because it is powerful, writes to production, or needs a credential. The deterministic question is whether the **exact requested action** belongs to the **exact approved plan** and whether its required server-side capability is ready.

```
raw plan
  ↓
DSG computes plan hash
  ↓
user approves exact hash
  ↓
preflight exact step
  ├─ ALLOW
  ├─ WAITING_PERMISSION
  └─ BLOCK
  ↓
execution
  ↓
evidence
  ↓
verification / proof receipt
```

## `ALLOW`

The exact action, target, parameters, agent identity, and approved plan match, and required capability is ready. Cinema may emit a scoped grant and the executor may run that step.

## `WAITING_PERMISSION`

The step remains inside the approved plan, but a credential, tool, infrastructure dependency, or server-side capability is unavailable. The orchestrator can resolve the dependency and retry the unchanged step without asking the user to approve it again.

## `BLOCK`

The action is outside the approved boundary: unapproved plan, wrong agent, changed action/target/parameters, or another deterministic boundary violation.

## Capabilities are resolved server-side

A caller can declare that a step requires a capability, but cannot assert that the capability is already available. Cinema derives readiness from trusted server configuration and does not return secret values.

## Observe and Enforce

### OBSERVE

Cinema records governance classification, evidence, and audit state without making that classification the customer's execution blocker. Observe mode is useful when integrating DSG into an existing workflow first.

### ENFORCE

When enforcement is explicitly enabled, governance decisions affect execution. Approved work continues; out-of-plan or unauthorized work is blocked or held.

Changing mode changes execution effect. It does **not** rewrite the underlying governance classification.

## Authorization is not audit storage

Preflight answers whether an executor **may** perform a proposed action. Execution recording answers what **actually happened**. If an executor violates a prior block, the raw trace should still be stored so the audit trail can prove the violation. Recording the violation never retroactively authorizes it.

## Evidence and exact verification

Cinema recomputes alignment, constraint results, execution coverage, evidence completeness, and replay matching from submitted raw material. Caller-supplied verdict fields are not accepted as proof.

Where the exact verification path requires Z3, verifier failure is fail-closed: no fabricated or degraded `PASS` is produced.

## Replay boundary

Replay is verification only. It re-checks recorded inputs, evidence, hashes, and deterministic postconditions. It must not silently re-send the original production action.