Skip to main content
A breach of a behavioural contract is a finding. A circuit breaker turns a finding into an action, so authority is withdrawn without waiting for somebody to read a screen. This is not request rate limiting. That is infrastructure, and your reverse proxy already does it. This is a control that revokes authority on the strength of what the record now says.

​
It cannot fire on noise

The property that makes a breaker safe is not tuning. It is that breached means the 95% confidence interval lies entirely past the limit — see conformance claims — and a breaker only ever reads breached. So a breaker cannot trip on an agent at 5.4% against a 5% ceiling over 40 decisions. That window is not_demonstrated, and nothing in the breaker path looks at not_demonstrated.
A breaker that revokes authority from a working agent is a worse outcome than the breach it was meant to prevent, and it is how a control gets uninstalled. The statistics close that case by construction rather than by a threshold somebody has to get right.

​
Observe first

A breaker ships in observe and records what it would have done. Arming it requires stating how many times it would have tripped over the last 90 days — and the number has to match what the platform computes:
The mismatch check is not a checksum for its own sake. It separates somebody who ran the numbers from somebody who posted the payload out of this page.
If the counterfactual says a breaker would have fired in most windows, that is telling you the contract is wrong, not that the agent is. Fix the contract.

​
What a trip does

notify

Raises a finding. Touches no authority.

revoke

Pulls the kill switch on the agent’s grants — each across its whole delegation subtree, so a delegate does not keep acting under authority whose root has just been withdrawn.
There is no third action, and none that widens anything. Nothing here promotes an agent, raises a ceiling or grants authority. A trip carries the name of whoever declared the contract it fired on, so the record reads this tripped because Sarah committed on 3 August that refusals would stay under 5% rather than naming a number with no owner.