WEBVTT

00:00.000 --> 00:24.382
PolicyStrata tests a failure mode in data agents. A policy is copied into several different representations, and those representations can stop agreeing. The tool checks each transition in execution order and reports the first contract that failed. We start with a synthetic case so every value is safe to show, then separate that demonstration from evidence collected on BetterOff's deployed production revision.

00:24.382 --> 00:48.614
The manifest tells the model what exists. The grammar defines valid intent. The validator authorizes a typed plan. The compiler lowers that plan to SQL. The database contains row access, and the release layer decides what can leave the system. A database can block bad SQL, but that does not erase an earlier compiler error. PolicyStrata keeps attribution and containment separate.

00:48.614 --> 01:11.500
The built-in demo runs fifty deterministic cases without calling a model. Each case contains a principal, request, semantic plan, version vector, database state, and expected release decision. The run emits JSONL traces and minimized witnesses. The aggregate count is a smoke test. The worked example is where the cross-layer behavior becomes visible.

01:11.500 --> 01:32.121
The model-facing surfaces and validator are on version seven, while the compiler is still on version five. The principal may ask for escalations in its own tenant. The canonical interpreter returns four rows. The stale lowering emits a predicate against legacy tenant id, so the lowered query returns twelve rows on the distinguishing database state.

01:32.121 --> 01:56.282
PolicyStrata attributes the fault to the compiler because it is the first surface that violates its declared responsibility. The database later contains the bad query, and the release layer blocks output. Those defenses matter, but they do not move the source of drift downstream. The witness retains the version vector, differing values, containment outcome, release decision, and bounded reduction.

01:56.282 --> 02:26.885
A fresh MetricFlow checkout reproduced sixty-eight checked-in traces byte for byte. MetricFlow maintainers authored the requests and expected SQL. Raintree authored the bridge because MetricFlow has no native principal, tenant, or release model. The scan produced no high-confidence failure, but it did produce ninety-five warnings. Sixty-eight fuzz mutations survived because the bridge role grants every dimension. This is adapter evidence, not a MetricFlow security claim or an externally operated study.

02:26.885 --> 02:54.859
BetterOff is in production. The study binds evidence to its exact deployed Git revision and Vercel deployment. Thirty-three live HTTP boundary probes passed and none failed. Three authenticated reads were skipped because no isolated production smoke principal is configured. On the same deployed revision, the checked-in adapter covers thirty-three tools, six SQL traces, and four database checks. Its disposable fixture scan passes with zero findings.

02:54.859 --> 03:24.350
The new evidence closes the claim that BetterOff is only a synthetic application fixture. It also replays two historical missing-RLS revisions that map to v1, plus an export-audit omission that falls outside the taxonomy. What remains is narrower. Authenticated cross-tenant probes need an isolated production smoke principal, and no external team has operated the deployment study. The paper preserves those boundaries along with every command, revision, input hash, and skipped probe.