Lesson 4.54.5 DSoR acts

In everyday life. A company does not hand a new AP clerk the bank password and say "pay whatever looks right." The clerk gets a desk with a login of their own and a list of what they may do. They also get a spending limit, a manager who approves large payments, and a logbook.

A DSoR, or Data System of Record, is that desk, governed, for an AI Worker. It is the layer between the worker and the company's real systems.

Its rule fits in two sentences: DSoR never takes the worker's word for anything. It checks for itself.¹ Every request to act passes the same checks.

1. Who is asking? The worker has its own identity, not a borrowed employee login.
2. Under whose authority? The worker acts for a named principal, inside limits that person was allowed to delegate.
3. Which rules apply? Limits and controls are checked by the system, not by the model.
4. Does a person have to approve? If so, the action waits in the approval queue until that person approves from their own login, at a time they choose.
5. What do the company's systems show now? DSoR reads current state itself. It does not trust the state the worker reports.
6. Has this already happened? A retried request must not pay an invoice twice.

Each action leaves evidence: who asked, under whose authority, which rules ran, who approved and what happened. It is one record per action, read as a list at Dave's Thursday review. In Part II the accounting system's approvals log stands in for it.

DSoR's six checks, the evidence it keeps, and why the layer exists.

Send a request through the six checks

Pick what the worker asks to do, and watch where DSoR lets it through, makes it wait, or stops it.

The worker asks to

Read Lakeshore's vendor recordPay the $7,800 Midwest Packaging invoiceMark invoice 5120 "approved by Dave"Send a payment again after a timeout

DSoR checks

1. Who is asking?Passes: The worker, with its own identity.
2. Under whose authority?Passes: Its named principal, inside the limits they delegated.
3. Which rules apply?Passes: Reading the vendor record is allowed.
4. Does a person have to approve?Passes: No approval is needed to read.
5. What do the company's systems show now?Passes: DSoR reads the record itself. Lakeshore is Net 15.
6. Has this already happened?Passes: A read can safely happen again.

Allowed

The worker gets the terms from the record, and the evidence says who read what, and when.

The reason is not that models are careless. An agent can be confidently wrong. It can be tricked by text it reads. And it retries things a person would not. Thursday showed the first two. A worker that runs at night also has nobody to ask, so the checks live in the system, not in a person who happens to be watching. In a run at night, DSoR is the only guard, and anything that needs a person waits in the approval queue. At nine, it gives the person the queue to clear and the evidence of what ran. Through a DSoR, "approved" is not a status the worker can type. It is an event recorded when Dave approves from his own login. The lookalike email came in through a channel, and what comes through a channel is text the worker read, so the most it can do is flag it, and the flag goes into the invoice's case file (4.4).

One more case belongs here. An action taken through a screen, by clicking where a person would click, passes no system's permission check and leaves no evidence of its own, because the application sees only a user clicking. The controls in this chapter reach only what comes through DSoR's door. So an action that matters, a payment, a status, an approval, never goes through the screen. Reading, drafting and building the register may.

DSoR in this book. DSoR is an open specification, and Part IV teaches it in depth. Until then, you set the worker's limits with the controls that products already offer: read-only access, approval steps, and no write access. In today's everyday products the worker acts under your own login, so your permissions are its limits, which is why those are the controls while the worker works only for you (4.10). Where a product allows it, IT issues the worker a login or key of its own, and the limits become its own. No write access does not demote the worker. It still holds the role, and the action waits for a person, which is the final 10 percent. Chapter 7 turns that into the Authority Envelope.