CAIN-42 CAIN StudioThe rule
Every decision runs a list of stages (identity, authorization, policy, risk, verification, approval, and the
restriction-only stages a call opts into). Each stage reports one of seven words. One pure function,
derive_outcome, turns the list into the verdict, and the live path, the simulator and the proof center all
call that same function.
| Stage says | Enforcing stage, enforcement on | Advisory stage |
|---|---|---|
allow | no objection | no objection |
deny | BLOCKED | ALLOWED_WITH_DENIALS (recorded) |
unavailable (could not run) | BLOCKED | ALLOWED_DEGRADED |
require_approval | REQUIRE_APPROVAL (waits for a human) | no hold |
skipped, not_configured, deferred | no objection | no objection |
| anything else: error, unknown, timeout, None, missing, DENY in capitals, allow on a stage that did not run | BLOCKED (since 2026-11-03) | ALLOWED_DEGRADED |
| no stages at all | BLOCKED (since 2026-11-03) |
A kill-switch halt blocks even in shadow mode. Shadow mode itself is a deliberate, visible setting: the verdict
says ALLOWED_WITH_DENIALS so nobody mistakes an observed denial for a clean pass.
Words the live stages use today: allow, deny, unavailable, skipped, not_configured, require_approval, deferred.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.