Semantic pattern · Paired policy-evaluation traces

Where policy traces diverge

Two requests traverse the same ordered rules. Explicit states distinguish a rule that does not apply from one the evaluator never reaches.

Where two policy evaluations first diverge Two requests pass identity and audience checks. At the data-class rule, the read-only request passes while the sensitive-write request fails; later rules are skipped or not reached, producing permitted and denied outcomes. ORDERED POLICY Trace A · read-only internal metrics request Trace B · sensitive write restricted records request 1 · Identity bound named principal required ✓ PASS ✓ PASS 2 · Internal audience employees only ✓ PASS ✓ PASS 3 · Data class restricted writes denied ✓ PASS × FAIL FIRST DIVERGENCE 4 · Human approval required only for writes — SKIPPED ○ NOT REACHED 5 · Deploy gate all reached rules must pass ✓ PASS ○ NOT REACHED OUTCOME Permitted OUTCOME Denied · review ✓ PASS × FAIL — SKIPPED · rule intentionally bypassed ○ NOT REACHED · earlier terminal result
←/→ step · Space play/pause · R replay · Home/End jump
Static frame · all 5 rules visible