Appendix B — Engineering Moves

B.6 Close the Action Surface

Problem. When a consequential operation can occur through arbitrary routes, governance must account for an open-ended set of ways to change the system. Validators, provenance, and policy cannot cover paths they cannot enumerate.

Move. Route consequential actions through a bounded, named interface. A closed action surface exposes a finite set of operations, each of which can carry policy, provenance, and validation.

Figure B.6-1 sets the open surface against the closed one.

C.6 Close the action surface: replace open-ended routes with one bounded, named interface On the left, an open surface: an actor reaches a consequential resource by arbitrary routes — a raw surface, another raw surface, a helper, and unknown paths — drawn as scattered thin dashed arrows, so governance must reason about an open-ended set of ways a change could happen. On the right, a closed surface: the actor reaches the resource only through one heavy, named seam that fans into a finite set of verbs, each of which can stamp provenance, validate, constrain, and observe. The two states are distinguished by shape, dash, and line weight, not by colour, so the contrast survives grayscale and colour-blindness. OPEN · any route actor raw surface raw surface helper unknown routes open-ended — governance faces arbitrary paths CLOSED · one named seam actor SEAM VERB A VERB B VERB C stamp · validate constrain · observe finite verbs — each carries policy, evidence, validation The distinction is encoded by shape, line style, and weight rather than color.
Figure B.6-1. Open surface versus closed seam. OPEN — an actor reaches a raw surface by many routes, including unknown ones. CLOSED — the actor passes through one seam that exposes a small set of named verbs, each able to stamp, validate, constrain, and observe. The distinction is encoded by shape, line style, and weight rather than color.

Example — Document mutation. DocAble routes remediation through a closed set of named mutator verbs. Because the verb set is finite, every verb can stamp provenance, register inserted content, and run the required checks. New capabilities must extend the verb set rather than introduce another ungoverned path.

Example — Infrastructure access. Raw queue operations are confined to one dispatch seam. Queue semantics and atomicity are encoded and reviewed at that seam rather than reconstructed at each call site.

Related mechanisms: Closed remediation-verb sets · PdfModel · Sole raw-Redis seam · ServiceClient · Canonical walkers · One Door Enforced.

© James C. Davis, 2026–present