Enforcement

Pillar-3 enforcement record — every decision, mode → action, with a signed evidence hash. Two paths, named on every row: pre-action events answer a gateway that asked before the agent acted; at-ingest events are policy verdicts recorded as telemetry arrived, after the fact.