Clear limits. Evidence you can inspect.
Before you connect real work, check what ZAK protects, where its coverage ends and what the records prove.
Illustrated scenario · no live execution
Why did we release it?
Start with the decision record.
- Who approved?
- The appointed release owner.
- Approved what?
- Release 42 to the customer portal.
- Which rule?
- Release rule, version 7.
- What did they see?
- The change, functional checks, security review and rollback plan.
- AI permission?
- Prepare only. The release service had separate authority to deploy version 42.
- What happened?
- The release service recorded deployment of version 42 at 09:14.
Put it to work.
Start with what needs to happen. Make the next decision clear.
What can reach the action?
Map the actual execution path, identity and permission checks. A separate path that bypasses the check remains outside its coverage.
What happens when a check fails?
Missing or invalid required authority must not be treated as permission. Verify the configured failure behaviour for the chosen integration.
What does the record establish?
Check the request binding, signer where applicable, evidence identity and storage guarantees. A local hash comparison alone does not establish those properties.
What will your team operate?
Agree the data handling, access, key custody, support and incident responsibilities for the deployment. Ask for the evidence relevant to your workflow.