Freeze What You Approved

"You don't approve an action. You approve an action against an exact list of machines — and that list must not move afterward."

Approval is consent to a blast radius

When you approve an operation, you aren't just saying yes, do the thing — you're saying yes, do it to exactly these machines. The set of targets is the scope of the risk you signed off on. Which is why that set gets frozen into a snapshot the instant approval happens.

A live selector betrays the approval

Imagine the target were a live query — all always-on servers — instead of a frozen list. You review it, it reads three machines, you approve. Then a fourth server finishes booting and now matches the query. With a live selector, it silently joins a batch it was never reviewed for. Freezing the exact host ids at approval closes that door: the set you saw is the set that runs.

Preflight proves reality still matches

Freezing the target isn't enough on its own, because the world moves between approval and execution. So just before running, preflight re-checks the preconditions on each frozen target — is it reachable, do its capabilities still match, is there a conflicting operation already in flight? Frozen target plus fresh preflight means: you approved a specific set, and reality still agrees when the work actually starts.

Verify and recover are decided up front

The operation also carries, from the moment it's planned, how it will verify success and how it will recover from failure. Both are written before running, never improvised mid-incident — because the worst possible time to invent your rollback plan is while the thing is already on fire.

Freeze what you approved. An approval that a moving selector can quietly widen isn't an approval — it's a blank space someone gets to fill in later.

Code

A frozen set, not a live query·python

# WRONG -- targets resolved live at run time:
#   op.targets = lambda: query("role = always_on")   # a 4th server can sneak in

# RIGHT -- resolved ONCE, frozen at approval:
op.target_snapshot = ["office", "server", "laptop"]   # exactly what Dad reviewed
op.approved_at = "2026-07-19T09:00:00Z"

# Just before running, preflight re-checks each FROZEN target:
for host in op.target_snapshot:
    assert reachable(host)
    assert caps_match(host, op.required_capabilities)
    assert no_conflicting_op(host)

# You approved a set; preflight confirms reality still matches it.
# Nothing new can enter the batch after the signature.

Exercise

Design an approval for 'update these servers.' Write the exact frozen list, then describe one machine that could become eligible between your approval and the run. What does freezing protect you from — and what does preflight catch that freezing alone doesn't?

Hint

Freezing stops NEW machines from joining. Preflight catches an already-APPROVED machine that changed — fell asleep, lost SSH, started another op — between sign-off and start. You need both: one guards the set, the other guards each member of it.

Approval is consent to a blast radius

A live selector betrays the approval

Preflight proves reality still matches

Verify and recover are decided up front

Code

External links

Exercise

Progress

Comments 0