Qeravio publishes four bounded control intents for every declared AI unit: stop, freeze, revoke and return to one exact verified Worker. Every valid intent still requires owner approval, an independent checker and a live control plane that is not implemented.
A verified rollback target does not prove a unit can be stopped.
This page does not prove live unit shutdown, in-flight cancellation, provider credential revocation, blocked external calls, authenticated owner control, tenant isolation, a completed rollback or zero data loss.
01 / Per-unit policy
Four intents. Nine units. No silent execution.
Every valid request is bound to one task, serving Worker, rollback Worker, requester class and fifteen-minute evidence window. Its result is verification required, never permission to act.
No exact-version stop-control policy is available for this response.
02 / Control meaning
Each intent names a boundary, not a completed event.
Unit scope
Stop
Requests no further task assignment to one unit. No scheduler is connected yet.
Operation scope
Freeze
Requests that one operation not advance. No in-flight cancellation is implemented.
Authorization scope
Revoke
Requests invalidation before another invocation. No provider credential is revoked here.
Worker release scope
Rollback
Names one exact previously verified Worker. This page does not deploy it.
03 / Open gates
What must pass before the plan can become control.
Gate 1Build an authenticated owner control plane before presenting any stop, freeze or revocation request as executable.
Gate 2Connect every tool invocation to one central fail-closed gate with durable cancellation and replay protection.
Gate 3Prove credential revocation at the provider and verify that cached or in-flight credentials cannot continue.
Gate 4Test the exact Worker rollback path under controlled failure with database compatibility and recovery evidence.
Gate 5Verify organization and member isolation so one stop request cannot affect another tenant or scope.
Gate 6Measure repeated control use, recovery time, recovery point and residual external effects before widening the claim.
Version binding
One serving Worker. One rollback Worker. One evidence window.