組織での適用：エージェントの副作用・復旧・人への引継ぎ

Source SHA-256 f45e9cba242d24b942acea4f6c41c83fe9863ddce44b621b90294cc28dad25fa

ORG_OVERLAY_ID: ORG-CORE-05-v0.1

TARGET_PACKET: PKT-GEMINI-A-CORE-05-v0.1

TARGET_MAPPING: PM-GEMINI-CORE-05-v0.1

AS_OF: 2026-09-06 23:02 JST

STATUS: DIRECT_ACTION_INTEGRATION_PROHIBITED / CHAT_SYNTHETIC_ONLY / ACTION_VALUES_UNKNOWN

LAYER: ORGANIZATION_OVERLAY (tenant and operating-environment facts only)

組織固有のapproved action surface、permission、approver、risk threshold、idempotency、receipt/readback、undo、recovery、incident ownerをCore/Product Mappingから分離する。既知の境界は、業務Geminiへのfile sync・API・直接統合は禁止、Gemini chatへのsynthetic prompt投入とGem構築試験は可能候補、というものである。公開product actionやADK runtimeを組織採用値へ補完しない。

• ROW: ORG-C05-001; Core / PM route: action surface / PM-C05-GEM-001; Required organization fact: approved surface/tool/system; allowed action class; data class; credential owner; execution owner; Current value: BUSINESS_GEMINI_CHAT_SYNTHETIC_ONLY; DIRECT_FILE_SYNC_API_INTEGRATION_PROHIBITED; actual action tools NOT_ADOPTED/UNKNOWN; Evidence / boundary: user clarification 2026-09-05; ORG-CORE-02..04; Closure condition: policy ownerがsurface/tool/action/data classを明示。禁止routeを試験待ちにせず候補から除外

• ROW: ORG-C05-002; Core / PM route: permission scope; Required organization fact: principal/delegator/resource/operation/argument/time/max-use/policy version; revocation owner; Current value: UNKNOWN; chat prompt入力以外のdelegated action permissionは確認しない; Evidence / boundary: direct credential/tool integration禁止; Closure condition: 採用する許可surfaceがなければNOT_ADOPTEDで閉鎖。採用時だけtask-scoped grantを承認

• ROW: ORG-C05-003; Core / PM route: approval / PM-C05-GEM-002/003; Required organization fact: risk tier、承認者、independence/competence、summary fields、digest、timeout、reapproval、break-glass; Current value: UNKNOWN; provisional=NO_EXTERNAL_ACTION_FROM_AI_CHAT; Evidence / boundary: public ADK dialogはorganization approval controlの証拠でない; Closure condition: action class別にowner/threshold/summary/reapprovalを決定。値がない間はdraft/manual execution

• ROW: ORG-C05-004; Core / PM route: idempotency / PM-C05-GEM-004/006; Required organization fact: operation ID、dedup store/TTL、key-mutation atomicity、attempt history、COMMIT_UNKNOWN owner、late-arrival rule; Current value: UNKNOWN / no authorized remote action test; Evidence / boundary: CORE-05 local 26/26はreference only。ADK #6732はorganization incidentでない; Closure condition: authorized system採用後にnon-secret testでresponse-loss、duplicate、retention expiry、readbackを固定版検証

• ROW: ORG-C05-005; Core / PM route: receipt/readback; Required organization fact: source-of-truth、receipt field、expected final state、readback owner/SLA、acceptance/retention/redaction; Current value: UNKNOWN; chat responseはaction receiptとして不採用; Evidence / boundary: existing UI logs are answer-surface only; Closure condition: service ownerがauthoritative readbackとacceptanceを定義。提供不能ならAIはA0/A1に限定

• ROW: ORG-C05-006; Core / PM route: undo/compensation / PM-C05-GEM-007; Required organization fact: undo level/window、secondary effect、compensation owner/precondition、manual repair、backup/RTO/RPO; Current value: UNKNOWN; Calendar等connected-app direct testは禁止; Evidence / boundary: public Calendar helpからtenantのundo能力を推定しない; Closure condition: actual adopted systemごとにNONE/PARTIAL/FULL/UNKNOWNとresidualを台帳化

• ROW: ORG-C05-007; Core / PM route: human escalation; Required organization fact: stop trigger、blast radius/amount/count、recipient/data sensitivity、reviewer、response SLA、incident owner、安全な代替; Current value: numeric/sector/owner/SLA UNKNOWN; safe default=DRAFT_ONLY_OR_HUMAN_EXECUTION; Evidence / boundary: Q-C05-003 Core axes only; public product defaults are not org values; Closure condition: policy/risk/service ownerが数値・owner・SLAを承認。未決定時はA2以上へ自動昇格しない

• ROW: ORG-C05-008; Core / PM route: safe UI observation; Required organization fact: synthetic-only、new chat/Gem flag、visible model、prompt/response digest、no tool/action、explicit limits; Current value: AVAILABLE for response-surface test; CORE-02で実施済み。CORE-05 action試験には不十分; Evidence / boundary: 3 model UI logs; all new chat; Gemなし; no external action; Closure condition: product change時に回答表面sentinelは再実行可能。ただしaction safetyやinternal runtime certificationへ使わない

• 業務Gemini chatは現行証拠上A0 READ/A1 DRAFTに限定し、外部send/create/update/delete/shareを実行routeへ含めない。

• file/API/direct integrationとconnected Workspace actionの実機試験はPROHIBITED_BY_ORG_POLICYとして除外する。

• public confirmation/undo/helpは製品面の存在証拠であり、組織のapproved control、trusted renderer、receipt/readbackではない。

• 外部操作が必要な場合はAIがtyped draft/action summaryを作り、人が正本systemで手動実行・確認する。

• risk threshold、承認者、dedup TTL、readback SLA、undo window、incident ownerはUNKNOWNのまま保持し、公開defaultで埋めない。

PM-GEMINI-CORE-05はGemini公開action/confirmation/resume/undo面を境界付きで整理した。本Overlayは、許容されたchat synthetic試験と禁止されたdirect action integrationを固定し、組織固有のaction値をUNKNOWNまたはNOT_ADOPTEDとして保持する。禁止経路の実測を待たずGemini CORE-05 cycleを閉じ、S063 Frozen TOCのCORE-06へ進む。