Hormuz Reference Scenario

1Synthetic data statement

In Verity Command, synthetic records are flagged as exercise data at creation and can never be promoted to real-world observation or distributed as real. That rule belongs to the architecture, not to this document. This walkthrough describes the defined behavior of the platform with invented data; it is not a record of an operation or a performance result.

The same scenario is available as an interactive twenty-step experience at veritycommand.com/missions/hormuz/.

2Why refusal is the centre

Most system narratives show a request succeeding. The half that matters in a governed system is the request that should not succeed, and what the system does with it.

Here a plausible, well-intentioned, urgent proposal is refused — not because the system failed, but because the basis for acting had not been established. The refusal is visible, itemized, attributable and recorded. What follows matters as much: independent evidence, an adjudicated contradiction, a human quorum, and an authorization deliberately narrower than the one first requested.

3The synthetic picture

Every record carries the marking SYNTHETIC — EXERCISE. Areas are referred to by designation only.

4Act 1 — An anomalous observation

Within the mission's area of interest, position reports from EXERCISE ALPHA stop arriving while radar holds a contact on its last track. A navigation-interference indicator appears in the same area shortly afterwards. Reality Fabric admits the records with source identity, label, time and uncertainty, and refuses a forwarded message that has no identifiable originator.

The statement "EXERCISE ALPHA went dark to evade sanctions" is refused as a single record. It conflates an observation about reception, an inference about intent and a legal characterization; each part must be stated as what it is.

5Act 2 — Correlation and contradiction

An analyst asks Intelligence to assemble what is known. The Reality Graph returns identity history, an ownership chain reaching EXAMPLE HOLDING COMPANY, correlated loitering by EXERCISE BRAVO and a geolocated open-source report — each with its source, statement type and confidence method.

Two things surface that a summary would have hidden. The ownership chain rests on a registry entry that a second registry contradicts. And three of the four supporting reports trace back to a single original source: aggregation has not created corroboration, and the lineage shows it.

6Act 3 — An AI-supported recommendation

An AI agent acting under the watch officer's delegation drafts a risk assessment that cites its records, states alternatives and flags the contradiction. Simulation compares observing and reporting with intercepting and inspecting, under recorded assumptions.

The draft is a recommendation and nothing else: an AI agent cannot approve, authorize or cause an effect, and an inference does not become an assessment by being persuasive.

7Act 4 — The proposed action

The watch officer, holding a valid grant within EXERCISE STRAIT WATCH, proposes a tasking order: divert a patrol asset to intercept and inspect EXERCISE ALPHA, and send an advisory to EXERCISE TERMINAL. The officer signs as first approver.

An enforcement point assembles the decision context — principal, session, device, mission, labels, purpose, action class, content digest and time — and asks the Authority Kernel. Preconditions hold: identity is known, policy is available, time is within bound and evidence can be written. Several rules match, and not all of them permit.

8Act 5 — The refusal

The refusal is itemized because an unexplained denial is operationally useless: the officer learns exactly which five conditions were unmet and therefore what would have to change. The record carries the policy version evaluated, so it can be reproduced later against that version.

9Act 6 — What did not happen

• No authority envelope was issued, so Tunnel Sovereign had nothing to distribute. Nothing was queued for later delivery.
• No order reached the patrol asset and no advisory reached the terminal operator.
• Verity Edge at the patrol asset held no envelope and would have rejected any instruction arriving without one. No partial effect occurred.
• The proposal, its reasoning, its supporting records and its refusal are all in the evidence chain.

A system that had merely warned the officer and then complied would have produced the same outcome as one with no governance at all.

10Act 7 — Evidence and quorum

The analyst works the five reasons rather than arguing with them. A separate registry with its own collection path confirms the ownership chain. Neither original record is overwritten; an accountable analyst signs an assessment that adjudicates the contradiction and states its basis. The new source does not derive from the original report, so the independence requirement is met.

The advisory is edited to remove the non-releasable material. The edit changes the content digest, and the first approval is invalidated by that change. Both approvers then sign the edited content on hardware-bound authenticators. An approval means agreement to a specific text, not to an intention.

11Act 8 — A narrow authorization

The authority envelope is signed, bound to the content digest, scoped to the mission, directional and valid for a defined window (SYN-EV-0744). The endpoint that holds it cannot extend it.

12Act 9 — Distribution and edge enforcement

Tunnel Sovereign's Distribution Endpoint verifies the envelope and encrypts end to end to the endpoints it names; the relay carries ciphertext and metadata and cannot read content. One recipient is offline and receives on reconnection only if the authorization is still valid then. EXAMPLE PARTNER NAVY receives a restricted view under a release decision, with two properties and one relationship withheld, and the operator can see both views side by side.

At the patrol asset, Verity Edge validates the envelope signature and digest, the mission scope, its lease, trusted time and revocation state. It records acceptance before releasing the observe-and-report tasking, and would reject an intercept instruction the envelope does not cover. After the window, it records the operational system's result as an execution receipt (SYN-EV-0752), and the new observations enter Reality Fabric with their own provenance.

13Act 10 — The evidence chain

The reconstructable record contains, in order: observations and sources; the refused record; the inference and method; the contradiction; the AI draft and simulation; the proposal; the refusal with its five reasons; the independent source and signed assessment; the invalidated and renewed approvals; the authorization and lease; delivery records without content; edge acceptance; and the execution receipt.

An evidence package covering this chain can be verified on a machine with no access to the platform, so the party checking the record does not have to trust the system that produced it.

14What this walkthrough does not prove

• Operational performance or scale. The scenario uses invented data and says nothing about behavior at operational volume.
• Independent assurance. No external assessment, certification, accreditation or interoperability conformance is claimed.
• AI quality. No accuracy figure is claimed.
• That refusal is always correct. A system tuned to refuse is as useless as one that always permits. The aim is refusals that are explained, bounded and recoverable — as here, where the refusal led to a better-formed action rather than paralysis.
• That the outcome was right. The record shows what was decided and why. It does not adjudicate whether the world was as the records described it.

15Related documents and revisions

• VC-PUB-001 · Trust, Authority and Evidence Architecture
• VC-PUB-002 · Public Threat Model and Security Boundaries

Document VC-PUB-003 · Version 1.1 · Published 16 September 2026 · PUBLIC EDITION · Synthetic data throughout
© 2026 Sovereign Inc. All rights reserved.