Deterministic execution engine
Actions run in sequences, one at a time, with a declared input contract and a declared output. A call to one of your systems, a rule evaluation, a piece of code, an OData operation. Each returns a result in the same shape and ends in an exit condition. The same input produces the same sequence of facts.
Prevents: a step deciding for itself, a retry that changes the answer, an outcome nobody can reproduce.
Policy matrices
A matrix is the policy for one kind of record: its states, which sequence runs in each state, and which state each exit condition leads to. If a route is not in the matrix, the move cannot happen. Matrices are versioned; publishing a new one keeps every old one, and each record knows which version governed each of its moves.
Prevents: a transition the policy never allowed, a rule change that erases what the rule used to be.
Immutable action log
Every action run writes one entry as it happens: the input, the output, the actor, the exit condition and the policy version in force. Entries are never edited or deleted. The log is the record of execution, not a report about it.
Prevents: a log that disagrees with what happened, a gap where the interesting step forgot to write.
Tenant isolation
Each customer's policies, records and log live in their own schema with their own database role. One tenant cannot read or reach another, at the database level rather than by application code being careful.
Prevents: one organisation's records or rules leaking into another's.
Human and system actions
A move can be made by a sequence, by a person, by one of your systems through the API, or by a model proposing through the same door. All of them go through the same gate and write to the same log, with the actor on the entry.
Prevents: the manual override that bypasses the policy, the integration that moves a record no one approved.
Inspection and replay
Any record's history can be read as a list or as the path it took through its matrix, with the routes it did not take still visible. Any decision can be reconstructed under the exact policy version that governed it, however many versions ago that was.
Prevents: "we can't tell you why" as the answer to an audit, a dispute or a subject access request.