ADR-005 Manual review before real release
| Status | Accepted |
| Date | 2026-09-20 |
Context
Even a correct state machine can be wrong about the world: a malicious trusted contact, a SIM swap, a forged story told to support, a bug. The first versions of Titip will not have enough operational history to justify unattended release.
Decision
No non-simulated transition to recipient access is allowed without manual_review_approved recorded on the release case by a reviewer actor.
The prototype implements simulation only. It must not expose an approval control that issues live tokens.
A global switch release.disable=true halts all real releases without taking the owner application offline. Any engineer response to a bad release starts with that switch.
Reconsidering full automation requires a new ADR after abuse-case review, not a configuration flip in production.
Consequences
- Time-to-release includes human delay. Product copy must not promise instant delivery on day 21.
- Reviewers need an evidence screen, not database access. That screen is in scope for alpha, not for the clickable prototype.
- Staff misuse is in the threat model. Approval without evidence codes is an invalid event and must be rejected.