AI 可以提出建議。Zof 判斷它是否有充分依據取得操作權限。
Control Plane 將變更、系統脈絡、風險、證據與企業政策整合為可強制執行的決策，並套用於操作實際發生之處。
五項輸入。 一個可強制執行的決策。
對於經由 Zof 處理的操作，Control Plane 會評估提議的變更、系統情境、風險、佐證及企業政策。
提出什麼，由誰或什麼提出，以及範圍為何。
System Graph 指出變更可能影響什麼，以及其關鍵程度。
受影響路徑的關鍵程度、影響範圍及事件歷史。
Verification Engine 已證明什麼，還缺少什麼。
組織制定的規則：所需佐證、核准人員、變更時段及資料界限。
技術要求已滿足。Payments Tier 0 政策要求在發布前由具名人員核准。
Four decisions today. Finer-grained control as policy matures.
Decisions are explicit and machine-enforceable. The initial vocabulary covers the cases most enterprises need first; advanced decisions shape how an allowed action runs.
Evidence and policy are satisfied. The action may proceed.
Policy forbids the action, or evidence shows it should not run.
Specific verification is missing. The action waits until it is produced.
Technical requirements are met, but policy demands a named human decision.
Allow with constraints on scope, time, or environment.
Allow a bounded rollout and observe before widening it.
Reverse an action whose observed outcome violates policy.
Propose a fix, which then earns its own right to run.
Not another dashboard. Enforced where actions happen.
A control decision is only worth something if it can stop an action. Zof applies decisions at the boundaries where consequential actions actually run.
- CI/CD pipelines
Merge and deploy gates in GitHub, GitLab, Jenkins, CircleCI, and Azure DevOps.
- Deployment infrastructure
Release promotion, environment changes, and infrastructure actions.
- Autonomous agent tooling
The tools coding agents and autonomous systems use to act, so proposals wait for a decision.
- Other action boundaries
Any boundary where a consequential action crosses into production can carry a Zof decision.
政策、角色與核准 是基本要素。
RBAC、SSO、具名核准、各環境的自主層級、資料界限及稽核軌跡，是組織向 Control Plane 表達政策的方式。
- 分別定義提出、驗證及核准變更的責任。
- 讓受治理的操作及復原作業經過已設定的政策決策。
- 將決策紀錄與所使用的政策版本維持連結。
模型越智慧， 獨立控制就越重要。
當最先進的模型與程式開發代理程式承擔影響更大的操作，問題便從能否行動轉為是否應該行動。具備系統情境、佐證及政策的獨立層，是企業回答此問題的方式。
在重大操作前設置獨立決策
預約 Reliability Sprint，在您的其中一個系統上檢視此閉環，或與 Zof 討論控制模型。
- 政策要求時由人員核准
- 將政策關卡連接至您的 CI/CD 及代理程式工具
- 私有部署選項
