When a permitted path turns out to be one nobody wanted, the reflex is the same everywhere: close it. Add a validation, remove the option, block the sequence. It’s fast. It’s also the cheap answer.
There is a second exit, and almost nobody considers it: decide that the outcome is acceptable, and sign it.
Take a multi-step flow that lets a customer change a detail after confirming. Nobody designed it for the change that arrives twice, out of order, from a client that never gets bored. The system permits it. The company never chose it.
Closing the path removes the behavior. Declaring looks at what the path actually produces and asks whether the company would stand behind that result. Sometimes it would. The second change costs a small fee and ends in a valid order. That outcome was always acceptable. It had just never been said out loud.
The two answers are not equal. A closed path is gone for everyone, including the people it quietly served in ways you never mapped. A declared path stays open and gains an owner, a boundary, and a definition of wrong.
Closing also scales badly. It handles one path at a time while the space of states keeps growing. A short list of acceptable outcomes covers paths nobody has enumerated yet.
That is why the policy is not “lock everything down”. Read that way, it turns into a backlog of patches, and the agent finds the next unplanned path anyway.
What it asks is narrower. For every path that is permitted but unplanned, someone with authority picks one of two answers and writes it down. Close it, or make it acceptable. Silence is the third option, and it is the one that decides by default.
Take the last odd path your team closed. Can you state in one sentence why its outcome was unacceptable, not just unexpected? If you can’t, it was closed by reflex, and something worth keeping may have gone with it.