Chapter 05 / 08
Make the rules hold
An invariant becomes a control when a mechanism prevents, detects, or refuses a violation.
A written rule needs a mechanism
An agent may read “never cross a tenant boundary” and still produce a path that does. Velocity asks where each important invariant is enforced and what evidence establishes that the enforcement works.
| Rung | Meaning | Example |
|---|---|---|
| PREVENT | The illegal state cannot be expressed through the constrained path. | A database constraint rejects the invalid write. |
| DETECT | A violation is possible, but a test catches it. | A regression scenario fails on the invalid transition. |
| RUNTIME_GUARD | The system refuses the violation and makes the failure visible. | A write aborts loudly when a precondition fails. |
| HOPE | The rule exists only in prose. | A document says a field must never change. |
Spend enforcement effort where failure hurts
Consider blast radius, silence, and reversibility. A high-blast, silent, irreversible failure requires structural prevention under Velocity’s proof model. Cheap, self-announcing, reversible failures can justify lighter treatment. Record that judgment with the invariant.
A loud runtime refusal can be a useful first binding while stronger prevention is developed. It is still necessary to make any deferred obligation visible rather than claiming the final protection already exists.
Pay attention to the seam
Some invariants span two subsystems and belong to neither test suite. For the list preference example, storage and login initialization may each pass their own checks while disagreeing about when a saved preference takes effect.
At design time, name the cross-boundary invariant, assign an owner, and decide which side enforces it. At closeout, prove the invariants the change actually touched, including those omitted from the original description.
Protect the protection
A preflight gate should run the guard’s actual predicate or dry-run the real operation. A convenient proxy can approve a path the real guard later rejects. Also check whether the guard can see every place the relevant truth lives.
Structural prevention must survive migrations and deployment tooling. Keep a standing invariant register and, where reasonable, a check that fails if a constraint or guard is removed. A control is only as durable as the machinery that preserves it.
Established Velocity guidance: Invariant Binding and System Invariant Register.