READINESSOPS BY SOLIFAN
From evidence togoverned execution.
SOLIFAN designs and implements how organizations decidewhat to delegate to AI, how far that delegation should extend,and how those decisions are carried into operations.ReadinessOps is the foundation of this work.
This guide follows the path from new evidence to an AI-generated proposal, human judgment, explicit publication, and execution controlled by the published boundary.
AI proposes. People decide. Publication defines the official state. Published boundaries control execution.
MODULES
M0 / OVERVIEW
Understand how SOLIFAN, ReadinessOps, and the decision-to-execution boundary fit together.
Produces evidence-grounded proposals and explains differences.
Owns delegation boundaries and official decisions.
Separates and enforces state transitions and execution conditions.
Question for this step
Are you deciding how to delegate before choosing what AI can do?
ReadinessOps is not primarily a model-comparison exercise. It defines an operable boundary: what AI may propose, when a decision returns to a person, and what must never be executed by AI.
Control invariant
Capability is not authorization.
Expected control check
Delegated, review-required, and prohibited work are distinguishable.
Question for this step
Who designs this system, and for what purpose?
SOLIFAN designs and implements how organizations decide what to delegate to AI, how far that delegation should extend, and how those decisions are carried into operations. ReadinessOps is the foundation of this work.
Control invariant
Present SOLIFAN as the provider and ReadinessOps as its operating foundation.
Expected control check
The provider–foundation relationship can be explained in one sentence.
Evidence and official sources
Question for this step
Have proposal, judgment, and enforcement been collapsed into one actor?
AI proposes, people own the delegation boundary and official judgment, and the system permits execution only from published state. Separating these responsibilities prevents conversational assent or model output from becoming authority.
Control invariant
Do not overlap AI, human, and system authority.
Expected control check
Each state change has an unambiguous owner.
Question for this step
In what order does new evidence become an execution condition?
Evidence is inspected, its impact is established, AI prepares a reassessment, and a person decides. The exact revision is then explicitly published; a gate checks the published boundary, and the result is connected through one trace.
Control invariant
Do not skip stages; keep publication between judgment and execution.
Expected control check
The order is Evidence → Assessment → Review → Publish → Gate → Trace.
Evidence and official sources
Question for this step
Are verified paths separated from organization-specific production requirements?
The public implementation is a reference that verifies design principles and control behavior. Production use additionally requires organization-specific RBAC, retention, monitoring, tenant isolation, incident response, and legal or regulatory controls.
Control invariant
Never present a reference build as production-ready.
Expected control check
VERIFIED and PRODUCTION REQUIREMENT are labeled separately.
Evidence and official sources
Question for this step
What starts a delegation-boundary review?
The process begins with new evidence. The next module shows how change becomes governed input through inspection, versioning, and impact classification rather than being consumed as an unqualified prompt.
Control invariant
Reassessment begins with identifiable evidence and a revision.
Expected control check
Evidence intake is clearly the next control point.
M1 / EVIDENCE
Inspect new evidence and establish its revision and impact scope.
Organizes the meaning and possible impact of inspected evidence.
Defines scope and materiality criteria.
Enforces pre-LLM inspection, versioning, and suspension transitions.
Question for this step
Is change received as a traceable unit?
Policy, contract, evaluation, and operational changes are registered as evidence with origin, time, and scope. The input is fixed as the basis for later judgment instead of overwriting current state.
STATE
Control invariant
Evidence carries provenance, receipt time, and scope.
Expected control check
New evidence and existing Current remain separate.
Evidence and official sources
Question for this step
Can uninspected input reach the model directly?
In the verified Google Cloud path, evidence is inspected by Model Armor before AI processing. Unsafe input is blocked and never reaches the model or downstream agents.
STATE
Control invariant
Inspect pre-LLM and never override a BLOCK downstream.
Expected control check
Blocked input never reaches AI.
Evidence and official sources
Question for this step
Does new evidence overwrite earlier decisions?
A new governed revision is created from inspected evidence. Earlier revisions remain in history so differences can be reviewed, reproduced, and rolled back.
STATE
Control invariant
Record change as a new revision; never edit Current in place.
Expected control check
Old and new revisions remain identifiable.
Evidence and official sources
Question for this step
Is the reassessment scope clear when evidence is received?
Evidence impact is established first to limit the boundaries, agents, and decision items that must be reassessed. The system does not send everything to a model while scope remains ambiguous.
STATE
Control invariant
Derive reassessment scope from established evidence impact.
Expected control check
In-scope and out-of-scope items are explicit.
Evidence and official sources
Question for this step
Does an agent keep running while a material assumption is changing?
When material drift affects the existing safety basis, the affected agent moves to SUSPENDED before reassessment. Suspension is a control state that pauses execution pending review—not failure or deletion.
STATE
Control invariant
Material drift triggers suspension before continued execution.
Expected control check
The affected agent is SUSPENDED and the reason is traceable.
Evidence and official sources
Question for this step
Can the input state be reproduced before processing continues?
The revision ID, evidence impact, affected agent status, and trace ID are checked together. Reassessment does not proceed if the control state is incomplete.
Control invariant
Do not begin reassessment from incomplete control state.
Expected control check
Revision, impact, status, and trace refer to the same event.
Evidence and official sources
M2 / ASSESS
Combine multiple perspectives into an evidence-grounded proposal for human review.
Reassesses the scoped change and proposes a decision pack.
Retains evaluation criteria, acceptance thresholds, and final judgment.
Checks grounding and state transitions; prevents self-approval.
Question for this step
Is the task sent to AI limited to what changed?
The reassessment request is assembled from established evidence impact and only the evidence it needs. This limits the model’s opportunity to reinterpret unrelated current state.
STATE
Control invariant
AI scope cannot exceed the human-governed impact definition.
Expected control check
Inputs, scope, and exclusions are visible.
Question for this step
Are different responsibilities being mixed into one model answer?
Governance, value, and routing perspectives are assigned to specialist agents that assess the same scoped evidence. Specialization does not grant execution authority.
STATE
Control invariant
Specialized analysis does not distribute authority.
Expected control check
Each output has an identifiable role and evidence basis.
Evidence and official sources
Question for this step
Are multiple assessments synthesized into a form a person can compare?
Specialist results are synthesized into a decision pack showing changes, evidence, risks, recommendations, and unresolved questions. It preserves decision-relevant differences—not only a conclusion.
STATE
Control invariant
Do not erase disagreement or unresolved issues during synthesis.
Expected control check
Proposal and evidence can be reviewed together.
Evidence and official sources
Question for this step
Can each material claim be traced back to supplied evidence?
Material claims in the decision pack are checked against evidence. Unsupported content is marked unresolved or sent for reassessment rather than presented to human review as established fact.
STATE
Control invariant
Unsupported generation cannot become a premise for official judgment.
Expected control check
Every material claim has evidence or an unresolved marker.
Evidence and official sources
Question for this step
Can a high-quality proposal automatically become approval?
Even a validated decision pack remains REVIEW_REQUIRED. AI neither approves nor publishes it; the proposal waits for human judgment.
STATE
Control invariant
AI output remains a proposal, never approval.
Expected control check
Proposal = REVIEW_REQUIRED / Approval = NONE
Evidence and official sources
Question for this step
Can the non-delegable boundary be stated at the action level?
AI may generate candidates, compare options, and organize evidence. It may not create human approval, publish official state, or perform protected execution.
Control invariant
Proposal capability never implies approval, publication, or execution authority.
Expected control check
Forbidden actions exist neither in the public UI nor its WebMCP tools.
M3 / REVIEW
Review evidence and differences, then record a human decision with rationale.
Presents candidates, differences, and evidence; does not decide.
Edits the boundary and approves, returns, or rejects.
Records role, exact revision, rationale, and time.
Question for this step
Can reviewers see what changed—not just the recommendation?
The reviewer sees the decision pack, source evidence, differences from Current, and unresolved issues in one context. Material claims remain traceable beyond the summary.
Control invariant
Keep evidence and differences visible at the point of judgment.
Expected control check
Current, Proposed, and Evidence are distinguishable.
Evidence and official sources
Question for this step
Can the delegation scope be revised as explicit conditions?
A person reviews action, tool, data, impact, and exception conditions, then narrows the delegation boundary, requires human review, or prohibits the action.
STATE
Control invariant
Boundary changes use human-readable conditions and explicit differences.
Expected control check
Before, after, and editor are visible.
Question for this step
Is the rationale preserved with the decision?
An authorized person approves, returns, or rejects the exact revision. Rationale and unresolved issues are recorded so the decision context can be reconstructed later.
STATE
Control invariant
Bind every decision to an exact revision and accountable person.
Expected control check
Decision, revision, rationale, actor, and time are present.
Evidence and official sources
Question for this step
Should current operating state change at the moment a person approves?
ReadinessOps treats approval and publication as separate state transitions. Approval records that a person accepts a proposal. Current State changes only when the exact revision is explicitly published.
Current therefore remains unchanged across this step.
STATE
Control invariant
Approval does not change Current State.
Expected control check
Proposal = APPROVED / Publication = NOT_PUBLISHED / Current State = UNCHANGED
Evidence and official sources
Question for this step
Who can explain this decision later?
Evidence, proposal, differences, and human rationale are connected through the same trace ID. A trace is not a single log line; it is the evidence chain for decisions and state transitions.
Control invariant
Never lose rationale or accountability from the decision record.
Expected control check
One trace ID connects Evidence through Approval.
Evidence and official sources
Question for this step
Can an approved revision remain unpublished?
After approval, the revision remains NOT_PUBLISHED. Whether and when to carry it into operations is handled as a separate publication decision.
STATE
Control invariant
Current remains unchanged until explicit publication.
Expected control check
APPROVED / NOT_PUBLISHED / CURRENT UNCHANGED
Evidence and official sources
M4 / PUBLISH
Publish the exact approved revision and update the active boundary.
May explain publication impact; never publishes.
Confirms the exact target and timing.
Publishes only the exact revision and preserves history.
Question for this step
Should this approved change enter operations now?
After approval, timing, dependencies, affected scope, and rollback conditions are checked. This separates content acceptance from the decision to change operations now.
STATE
Control invariant
Keep approval and the publication decision separate.
Expected control check
The target revision and publication conditions are explicit.
Question for this step
Can the system publish only the exact revision that was approved?
Publication verifies that stored human approval matches the exact revision. It does not substitute another revision or infer authorization from conversation.
STATE
Control invariant
The approved and published revisions must match exactly.
Expected control check
Approved revision ID = Published revision ID
Evidence and official sources
Question for this step
Which boundary becomes authoritative after publication?
Publication creates a new ACTIVE boundary. The prior version remains in history as SUPERSEDED, and the execution gate consults only the new active version.
STATE
Control invariant
Exactly one ACTIVE boundary governs execution.
Expected control check
Previous = SUPERSEDED / Published = ACTIVE
Evidence and official sources
Question for this step
Should publication alone restart the agent?
Publication and restoration to READY are separate state transitions. The agent resumes only after required checks complete and the published boundary is available to the gate.
STATE
Control invariant
Do not combine official-state change with execution restart.
Expected control check
Boundary = ACTIVE / Agent = SUSPENDED until reactivation checks pass
Evidence and official sources
Question for this step
Can this decision be reconstructed when the next evidence arrives?
Evidence, revision, AI assessment, human judgment, publication, and the active boundary remain connected in history. The next change starts a new revision without overwriting Current.
Control invariant
Separate Current from history while keeping decisions traceable.
Expected control check
Current, Superseded, and Proposed remain distinguishable.
Evidence and official sources
M5 / EXECUTE
Use identity and a deterministic gate to execute only inside the published boundary.
May propose or request a protected action; cannot execute it directly.
Owns the published boundary and exception handling.
Deterministically checks identity, READY, active boundary, and duplicates.
Question for this step
Are the action and its impact explicit before authorization?
An execution request identifies the action, tool, target data, intended effect, impact scope, and requester. A natural-language instruction alone is never execution authorization.
STATE
Control invariant
Structure the request; never treat conversation as authority.
Expected control check
Action, tool, data, impact, and identity are present.
Question for this step
Is authorization based on published conditions rather than model self-assessment?
The gate deterministically checks agent READY status, the active boundary, requested action, data, and impact. An out-of-boundary action is DENIED even when the agent is READY.
STATE
Control invariant
Execution authorization is not delegated to model discretion.
Expected control check
READY + OUTSIDE BOUNDARY = DENIED
Evidence and official sources
Question for this step
Can the identity that performs analysis also execute protected actions?
The Google Cloud implementation rejects protected execution from Analysis Identity A. Analysis and execution are separated at the identity layer, beyond what a prompt or tool call can bypass.
STATE
Control invariant
The proposing identity has no protected-execution authority.
Expected control check
Analysis Identity A → DENIED
Evidence and official sources
Question for this step
Does the correct identity still recheck the boundary before execution?
Only Executor Identity B can reach protected execution. Even with the correct identity, the gate rechecks the active boundary and action conditions, executing only what is permitted.
STATE
Control invariant
Require both identity authentication and boundary authorization.
Expected control check
Executor B + ACTIVE boundary match = PERMITTED
Evidence and official sources
Question for this step
Can evidence be followed all the way to the execution result?
The same trace ID links evidence intake, inspection, revision, AI assessment, human judgment, publication, gate decision, and execution result. Duplicate requests are identified and are not executed twice.
Control invariant
Do not fragment state transitions and outcomes across unrelated logs.
Expected control check
One trace ID / duplicate request = ignored
Evidence and official sources
Question for this step
Has any boundary between proposal and execution been bypassed?
AI proposes. People decide. Publication defines official state. Published boundaries control execution. Together, these form the ReadinessOps operating model.
Control invariant
Preserve all four principles across UI, state, identity, and gate.
Expected control check
Proposal ≠ Approval ≠ Publication ≠ Execution
Evidence and official sources
ARCH / GOOGLE CLOUD
Review the Google Cloud architecture, verified path, safety behavior, and limitations with sources.
Performs analysis and reassessment on Vertex AI.
Retains responsibility for review and publication.
Enforces boundaries through cloud services, identity, gate, and trace.
Question for this step
Can the implementation be explained by responsibility?
The architecture is read as four control planes: Evidence, Analysis, Human, and Execution. Even if services change, intake, analysis, judgment, and execution control remain distinct.
Control invariant
Show responsibility boundaries before product topology.
Expected control check
Evidence, Analysis, Human, and Execution are distinguishable.
Evidence and official sources
Question for this step
Which control responsibility does each service carry?
The public implementation combines Vertex AI, Agent Development Kit, Agent Runtime, Agent Identity / Gateway / Registry, Model Armor, Cloud Run, Pub/Sub, Cloud Storage, Firestore, Cloud Build, Artifact Registry, and Cloud Logging.
This is an implementation fact, not a claim of partnership or production assurance.
Control invariant
Do not extend component names into unverified capability claims.
Expected control check
Each component maps to a control plane.
Evidence and official sources
Question for this step
Which state transitions were actually verified?
The public README records this path: Evidence → Model Armor → governed revision / evidence impact → specialist reassessment → Human Review → Explicit Publish → deterministic gate → Trace.
This guide explains that verified path without adding unverified production claims.
Control invariant
VERIFIED is limited to what public evidence supports.
Expected control check
The guide sequence matches the public README’s golden path.
Evidence and official sources
Question for this step
Are denial and retry paths verified alongside success?
Verified behaviors include pre-LLM blocking, denial of Analysis Identity, denial outside the active boundary, duplicate suppression, retry of the same revision, one trace ID, and a permitted path through Executor B.
Safety is demonstrated not only by what succeeds, but by what reliably stops.
Control invariant
Acceptance tests include both allow and deny behavior.
Expected control check
Check BLOCK, DENIED, duplicate, retry, trace, and permitted paths.
Evidence and official sources
Question for this step
Are out-of-scope areas stated as clearly as verified behavior?
The public demo uses synthetic text evidence and contains no customer data or PII. General PDF processing and production enterprise connectors are out of scope. Production use requires additional organization-specific authentication, authorization, retention, monitoring, and tenant isolation.
Control invariant
Limitations sit beside verified facts, not in fine print.
Expected control check
Demo scope and production requirements remain distinct.
Evidence and official sources
Question for this step
Can readers verify the guide against primary sources?
Readers can continue to the SOLIFAN official site, the Google Cloud and Snowflake repositories, the AI Delegation Boundary WebMCP implementation, and official Chrome and Firebase documentation.
Control invariant
Verifiable claims link to stable primary sources.
Expected control check
Each source exposes its name, URL, and review date.
Evidence and official sources
OFFICIAL SOURCES
