https://asibackbone.github.io/Learning/ Long-form technical articles from Accountable Systems Infrastructure (ASI) Backbone Learning on governed .NET decision flow and execution, secure application architecture, AI integration, and policy-driven systems. en-us Sun, 30 Aug 2026 19:48:38 GMT https://asibackbone.github.io/Learning/images/asibackbone-feed.png https://asibackbone.github.io/Learning/ 144 144 https://asibackbone.github.io/Learning/architecture/growing-beyond-a-simple-application-structure.html https://asibackbone.github.io/Learning/architecture/growing-beyond-a-simple-application-structure.html Add application and domain boundaries only when they solve concrete complexity, dependency, testing, or reuse problems. Sun, 30 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/articles/2026/why-ai-tool-call-is-only-a-proposal.html https://asibackbone.github.io/Learning/articles/2026/why-ai-tool-call-is-only-a-proposal.html A model may propose a tool call, but valid JSON and a known tool do not create authority; the trusted host still owns context, authorization, credentials, and execution. Fri, 28 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/articles/2026/test-denied-operation-never-executes.html https://asibackbone.github.io/Learning/articles/2026/test-denied-operation-never-executes.html A denied result is useful evidence, but a denied result plus zero protected executor calls proves the execution boundary held. Wed, 26 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/articles/2026/when-aspnet-core-authorization-is-not-enough.html https://asibackbone.github.io/Learning/articles/2026/when-aspnet-core-authorization-is-not-enough.html ASP.NET Core authorization is often the right answer; add a broader decision/execution lifecycle only when workflow, time, authority, or evidence crosses the request boundary. Wed, 26 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/architecture/agent-and-tool-authorization-models-and-host-owned-execution.html https://asibackbone.github.io/Learning/architecture/agent-and-tool-authorization-models-and-host-owned-execution.html Tool visibility and agent allowlists can reduce proposal and attack surface, but execution authority depends on where trusted context, credentials, policy, and side-effect ownership actually live. Mon, 24 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/architecture/api-gateways-service-meshes-zero-trust-and-governed-execution.html https://asibackbone.github.io/Learning/architecture/api-gateways-service-meshes-zero-trust-and-governed-execution.html Transport controls, workload identity, zero-trust strategy, and governed execution can reinforce one another without solving the same problem. Mon, 24 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/architecture/cqrs-command-query-separation-and-governed-execution.html https://asibackbone.github.io/Learning/architecture/cqrs-command-query-separation-and-governed-execution.html CQRS separates mutation requests from reads; governed execution adds policy, acknowledgment, provenance, and bounded continuation authority only when those lifecycle boundaries are actually required. Mon, 24 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/architecture/event-sourcing-audit-trails-and-governance-decision-provenance.html https://asibackbone.github.io/Learning/architecture/event-sourcing-audit-trails-and-governance-decision-provenance.html Event sourcing makes domain events the source of application state; governance evidence explains why authority was granted, denied, deferred, acknowledged, or exercised. Mon, 24 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/architecture/policy-engines-rules-engines-and-distributed-policy-enforcement.html https://asibackbone.github.io/Learning/architecture/policy-engines-rules-engines-and-distributed-policy-enforcement.html Rules engines centralize decision logic, policy engines externalize policy evaluation, and distributed enforcement separates decision from enforcement across one or more system boundaries. Mon, 24 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/architecture/workflow-engines-human-approval-and-governed-execution.html https://asibackbone.github.io/Learning/architecture/workflow-engines-human-approval-and-governed-execution.html Workflow state, human approval, policy decisions, and execution authority can coexist without being treated as the same architectural responsibility. Mon, 24 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/architecture/role-based-claims-based-and-capability-based-authorization.html https://asibackbone.github.io/Learning/architecture/role-based-claims-based-and-capability-based-authorization.html Roles, claims, and capabilities represent authority differently; choose the smallest model whose trust boundary matches the operation. Sun, 23 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/articles/2026/authorization-check-runs-too-late.html https://asibackbone.github.io/Learning/articles/2026/authorization-check-runs-too-late.html Authorization can succeed while resource-state or workflow rules still block execution; resolve that decision before protected side effects begin. Sun, 23 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/articles/2026/ci-badge-does-not-prove-package-integrity.html https://asibackbone.github.io/Learning/articles/2026/ci-badge-does-not-prove-package-integrity.html A practical guide to tracing a NuGet package from reviewed source through build, publication, and verifiable release evidence. Sun, 23 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/architecture/when-a-simple-application-service-is-enough.html https://asibackbone.github.io/Learning/architecture/when-a-simple-application-service-is-enough.html Use a broader governed-execution lifecycle only when the problem needs boundaries beyond ordinary application orchestration. Wed, 19 Aug 2026 00:00:00 GMT Christopher D. Cavell https://asibackbone.github.io/Learning/architecture/when-aspnet-core-authorization-is-enough.html https://asibackbone.github.io/Learning/architecture/when-aspnet-core-authorization-is-enough.html Built-in policies and handlers cover more than teams sometimes assume. Fri, 14 Aug 2026 00:00:00 GMT 2026-08-20T00:00:00Z Christopher D. Cavell