Process / Workflow

Separate family, edition and run identity

A process family groups immutable definition editions. A run points to one edition at a time through an explicit adoption history; neither a file path nor a run identifier identifies the family. A definition can exist before any run.

1. Which authoritative system, process key and edition identify the definition? identity
2. Is this record a definition, a run, a step occurrence or a projection? classification
3. What repeatable purpose, trigger and completion criterion delimit this process? definition
4. Which adopted method edition is referenced, if any? relationship

Control release and instance migration separately

Definition release is a local governance decision. Record the approver, effective interval and supersession. Existing runs retain their edition unless an authorized migration records old and new bindings, active work mapping and unresolved effects.

1. Who approved this edition and within which process ownership scope? authority
2. Is the edition draft, released, deprecated or withdrawn and what use remains permitted? lifecycle
3. How does a proposed migration map active steps, outstanding messages and compensation obligations? process
4. What change evidence and rollback limits accompany the revision? evidence

Declare the actual routing semantics

Record nodes, edges, guards, loops and synchronization under a named semantic profile. A drawing alone does not establish executability. Optional case planning and computational scatter need their own constraints, not forced conversion to one universal sequence.

1. Which steps, subflows, branches and joins belong to this edition? composition
2. How are guard failures, multiple true guards and missing guard data handled? constraint
3. Which concurrent branches must finish before a join may proceed? state
4. Which loops, optional steps or runtime plans are permitted and how are runaway paths bounded? exception

Keep dependencies distinct from payload ownership

Describe typed input and output references, validation and availability. Link subject records and external interfaces without absorbing their master data. Missing, null, skipped and failed output states must remain distinguishable in the selected binding.

1. Which inputs must be available before each step is eligible? requirement
2. How are output type, completeness and acceptance checked? quality
3. Which system owns each subject or payload and which snapshot was used? relationship
4. How are skipped, null, missing and failed outputs represented by the chosen adapter? interoperability

Separate role suitability from permission

Define eligible roles, capability references and assignment constraints. A lane label, agent capability or claimed delegation is not permission to act. Definition stewardship and execution record custody may be held by different accountable parties.

1. Who stewards the definition and who controls each run record? ownership
2. Which capabilities and separation-of-duty constraints apply to the step? requirement
3. What evidence makes a proposed performer eligible at the intended action time? authority
4. What substitution or delegation is allowed when the assigned performer is unavailable? exception

Evaluate authority for each operation

Proposed policy checks bind actor, target, operation and context. Read access to a definition does not grant access to execution evidence. Intervention, reassignment, cancellation and disclosure have independent scopes, reasons and review records.

1. Which actor may read this definition, run, finding or artifact for the declared purpose? access
2. What operation-specific evidence authorizes a state-changing intervention? security
3. Which execution details must be minimized or withheld from monitoring and aggregate views? privacy
4. Which retention, hold and disposal decisions govern the execution evidence? retention

Track one run independently of its subject

A run has a stable scoped identifier, edition binding and local lifecycle. Waiting, suspended, failed, cancelled and completed states are not interchangeable. Workflow completion does not certify a subject outcome or update a separate case master.

1. What run identifier and initiating evidence distinguish this occurrence from a duplicate request? identity
2. What is the run state and which active branch configuration supports it? state
3. What evidence establishes completion, cancellation or failure and any remaining obligations? lifecycle
4. Which case, task or service references this run without sharing its identity? relationship

Preserve occurrences, attempts and observation limits

Each repeated or parallel step occurrence gets its own identity, with separate attempt identities for retries. Capture performer, inputs, outcome and event time apart from observation time. Atomic acts are optional evidence references with no one-to-one claim.

1. Which run, step occurrence, iteration or branch and attempt does this observation concern? identity
2. When did the event happen and when was it observed, with what offset and uncertainty? temporal
3. Who asserted the step result and which input, output and act evidence supports it? provenance
4. How are late, duplicated, conflicting or missing observations represented? quality

Distinguish allowed variation from nonconformance

A deviation records the affected edition and path, evidence, impact and disposition. Permitted runtime planning is not automatically a breach. Escalation requests a decision; recording it neither authorizes an exception nor proves recovery.

1. What observed behavior differs from the adopted rule and what remains uncertain? exception
2. Is this allowed variation, missing evidence, an execution failure or an unauthorized deviation? classification
3. Who can approve or reject the proposed disposition and under which authority? decision
4. Which unresolved impact and follow-up obligations survive escalation closure? evidence

Do not equate retry, cancel and reversal

Recovery proposals preserve prior attempts and unknown external outcomes. Cancellation can stop future work without reversing effects. Compensation is separately authorized work with its own result and possible failure. Transport idempotence alone does not establish business exactly-once execution.

1. What proves a retry is safe when the previous attempt outcome is unknown? constraint
2. Which timeout, backoff and escalation policy applies to this failure? process
3. Who authorized cancellation or compensation and for which effects? authority
4. Which effects remain irreversible, partially compensated or unconfirmed? state

Qualify metrics by population and evidence

Assessments pin the definition, observation set and metric rule. Distinguish elapsed, working and waiting time; incomplete runs need explicit inclusion rules. A trace can disagree with a model because the evidence is incomplete. Performance data does not itself justify personnel ranking.

1. Which metric formula, unit, population and observation window produced this value? measurement
2. How are pauses, calendar effects, clock error and unfinished runs treated? temporal
3. Which paths were tested and which deviations reflect missing evidence rather than a proved breach? validation
4. What disclosure assessment permits this aggregate without exposing individual execution details? privacy

Declare mapping scope and semantic loss

A mapping pins a notation edition, adapter and supported subset. Distinguish structural validity from execution equivalence and operational fitness. BPMN, CMMN, SCXML and CWL cover different concerns; none is asserted as an interchangeable universal schema.

1. Which notation edition, profile and adapter version are used for this exchange? interoperability
2. Which unsupported constructs or semantic losses block execution or round-trip claims? validation
3. What original artifact and transformation history accompany the exported projection? provenance
4. Which adversarial fixtures and independent reviews remain necessary before operational adoption? requirement