SUMMARY: An expiration clock gives every provisional status a bounded lifetime. It defines when the state ends, what evidence can renew it, which safe condition follows, and how the change reaches every system that received the original status.
A timestamp alone is not a control. The clock must trigger behavior. When the deadline arrives, the system should stop using the provisional state unless an authorized process has supplied current evidence and recorded a new reason for continuation.
1. Inventory Provisional States
List states such as pending, under review, temporarily restricted, unverified, elevated risk, or awaiting confirmation. Include manual labels, database fields, cached decisions, and statuses received from outside systems. Start with states that can deny service, alter movement, freeze value, or damage a durable record.
2. Assign a Maximum Lifetime
Choose a duration based on consequence and evidence decay. High-impact restrictions should have short lifetimes and fast review. The maximum lifetime belongs in executable configuration, not only in policy text.
3. Define the Safe End State
Decide what happens when the clock expires without renewal. Do not leave the system to preserve the old value by default. The end state may restore prior access, narrow the restriction, route the case to a named reviewer, or mark the status unusable until new evidence arrives.
4. Require Evidence for Renewal
A renewal must record the evidence class, responsible authority, reason, new expiration time, and systems affected. Prevent repeated renewal from becoming an invisible route to permanence. After a defined number of extensions, require a higher level of review.
5. Carry the Clock Downstream
Use the status propagation graph to send both the state and its expiration metadata. A receiving system should reject a provisional label that lacks a valid deadline or refresh source.
6. Make Remaining Time Visible
Show affected participants and operators when the state began, when it ends, who owns the review, and what event can change it. This keeps provisional permanence from hiding behind vague interface language.
7. Drill Expiration and Correction
Create a test status, propagate it through every recipient, let it expire, and verify that the safe state appears everywhere. Then renew it with valid evidence and confirm that the audit trail distinguishes the original decision from the renewal.
Pair this drill with the decision pause. The pause protects the review interval; the expiration clock prevents that interval from becoming a permanent condition.
Operator rule: every provisional status needs an executable end, and every extension needs fresh authority.
Continue the discussion in the Clandestinia forum.