An invoice workflow's owner will add a standing rule forbidding direction from supplier email — what do you tell them?

## What is actually being proposed The run restates the buyer's standing routing and approval rules at the top of every execution. The owner wants one more line among them, to the effect that correspondence is not a source of direction. It is a cheap change, it can ship today, and it will make the demonstrated span stop working. All three of those are true, and none of them is the question. ## What the addition buys, stated precisely It raises the drafting cost of spans that address the model and ask it to act. Those are the crude family — the one most heavily represented in refusal training and in screening corpora, and the one that already performed worst. Making the weakest construction weaker is a real gain and should be reported as one, but it is a gain against the part of the distribution that was already covered. ## What it cannot buy, and why The construction that beat the earlier orders never presented as direction. It presented as content: an assertion about the transaction from which a different task followed. A rule about instructions binds text that reads as instructions. It has no grip on text that reads as fact, and the run cannot tell the two apart, because separating them is not a property of prose — the workflow exists to read supplier correspondence as fact, and stripping that would remove the feature, not the flaw. The honest way to put this to an owner is as a claim boundary. After the change they may say: the crude shape now costs more. They may not say: the workflow no longer takes direction from email. If a stakeholder further downstream will hear the second sentence when you say the first, that is a communication risk to manage, not a detail. ## Where the finding actually sits The payoff in this class is not a leaked secret. It is the filed verdict — a routing or approval decision written into the system of record by an unattended run, which every later reader treats as already checked because a machine signed it, and which no prompt wording touches. That property was created by the decision to run the routine path unattended and to let its output inherit the credibility of a checked decision. So the adjudication is about ownership. The prompt text is owned by whoever writes the run's preamble; the residual risk is owned by whoever owns filing unreviewed verdicts and by whoever consumes them downstream. Routing the finding to the prompt author closes a ticket and moves nothing, and that misallocation is the most common organisational outcome of this class — the cheapest owner is the one who gets it. Say plainly which changes are cheap-and-narrow and which are expensive-and-structural, price both, and let the person who can authorise the expensive one make that call rather than making it for them by silence. ## What re-testing proves Expect to be shown, in a week, that the reported span no longer works. That is evidence about one construction. It is not evidence that the class is closed, for two reasons: the class is defined by a property of the pipeline rather than by any string, and adherence is probabilistic, so a construction can fail a re-run it would have passed on a different day. A verification that consists of re-running the one artefact in the report is the weakest form of evidence available, and a lead should say so before it is presented as closure. ## What a red-team programme should carry away Two standing positions are worth holding. First, a finding whose remedy is a wording change should be reported with the wording change already priced, so nobody mistakes the cheap fix for the scope of the problem. Second, when the payoff of a class depends on an output being treated as authoritative, the durable question is who is entitled to treat it that way — and that is a governance answer, not a prompt answer. Both belong in the report at the time of filing, because after the cheap change ships, the appetite for the expensive conversation is gone.