{
  "argument": "Speed is useful only after authority and consequence boundaries are established; technical access must not create its own mandate.",
  "canonicalUrl": "https://xn--mwe.com/assurance-case/claims/authority-and-mission-boundary/",
  "claim": "Every automated protection action and any external mission support is traceable to a competent authority, named asset scope, allowed effects, prohibited outcomes, duration, stop conditions, and review route.",
  "defeaters": [
    "missing authority",
    "expired approval",
    "ambiguous asset ownership",
    "unresolved jurisdiction",
    "action outside approved effect envelope"
  ],
  "evidenceRequirements": [
    "signed authority record",
    "asset and identity scope",
    "allowed-action matrix",
    "prohibited outcomes",
    "deconfliction record",
    "expiry and revocation evidence",
    "review and appeal path"
  ],
  "hazards": [
    "unauthorized access",
    "third-party impact",
    "mission conflict",
    "unreviewed escalation"
  ],
  "id": "AC-K05-C01",
  "name": "Authority and mission boundary is explicit",
  "recoveryObjectives": [
    "automatic action stop on authority failure",
    "preserve signed decision state",
    "restore least-privilege baseline"
  ],
  "releaseId": "K12-2026-08-16",
  "siteTailoring": [
    "operator and licensee roles",
    "government mission authority",
    "third-party service boundaries",
    "jurisdiction and contract"
  ],
  "slug": "authority-and-mission-boundary",
  "sourceIds": [
    "SRC-WH-CYBER-CRIME-MEMO-2026",
    "SRC-NRC-10CFR-73-SUBPART-J-2026"
  ]
}