A model vendor’s deprecation page puts a retirement date on every model it serves, with about sixty days between the notice and the day requests start failing. An approval bound to a hash of the spec voids itself when the spec changes and never hears about the executor changing.

Paper GMP records don’t allow an empty box: you cross it out, write N/A, initial it, date it. The database that replaced the form has a type for the empty box, and it spells four different absences the same way. Every count you run picks one of the four for you.

A vendor deprecates by announcing a date because it can’t see its callers. An internal platform can read every caller and open a pull request against it, and most platform teams copy the vendor’s playbook anyway. The part of the migration that lever can’t cover is the consumer’s sign-off.

Dry-run is the default in the operational layer I built around an unattended coding agent, and I’ve been reading more into that flag than it can deliver. A dry run is faithful up to the first side effect the agent reads the result of. After that it’s a run through a world the agent made up.

A sample ID like SITE04-PRT19-2021-00381 is four definitions promoted into a key. The audit trail can correct any column in the record and can’t touch the key, and then the key gets printed on a tube that sits in a freezer for decades. No steward ever gets to retire that one.

Google’s review tooling gives engineers a button that says the analyzer was wrong, and disables analyzers that collect too many of them. An agent never presses it, so a guard pipeline aimed at agents loses the only instrument that ever measured its own rules.

A shared platform ends up at the strictest requirement any of its consumers carries, and onboarding is when that gets decided. Vendors fence off the strict part. An internal platform team usually can’t, and the mark only ever moves up.

Warehouse operations checks its records against the shelf on a rotating schedule and knows its match rate. A data stack checks records against records, so it can agree with itself completely and still be wrong about what’s in the freezer.

Last month’s GxP post ended on an open question about agent-written changes swamping per-change assurance. Manufacturing hit that wall a hundred years ago and wrote down its answer, and the answer has an entry fee agent pipelines can’t pay yet.

A storage platform can enforce any retention clock you hand it. What it can’t do is know which clock a record is on, and the only moment that answer can enter the system is the write. So the real policy decision is a schema token: required, or defaulted?