Boundary Essay

SimpleStates exists to separate factual state from application behavior.

Its tools emit deterministic signals. They do not authenticate users, authorize actions, block requests, run workflows, or decide outcomes.

SimpleStates stops at state.

Your application owns identity, business rules, authorization, gating, side effects, human overrides, and final judgment.

This boundary is not a limitation. It is the product.

Most boundary failures begin when a system treats a readable fact as if it were an executable decision.

• State is a fact your system can read.
• Outcome is behavior your system causes.

SimpleStates builds state primitives. Your application implements outcomes.

Outcome logic is application-specific. It depends on routes, domain rules, user experience, risk posture, and operational judgment.

A generic outcome layer tends to become one of three things:

• over-promised and incorrect
• too invasive to integrate safely
• a hidden dependency that becomes a new outage surface

SimpleStates refuses that role. It emits a small set of facts at read time. Your code decides what happens next.

• Not denied ≠ permitted. It only means no denial signal is currently present.
• Not expired ≠ authorized. It only means the expiry signal does not currently indicate expiration.
• Plan state ≠ permission. It is one input among many in your own enforcement logic.
• Evidence ≠ judgment. A snapshot can explain what was known; it does not decide whether the outcome was correct.
• Absence of a restriction is not permission.

SimpleStates is self-hosted. Your environment can misfire. Networks can fail. Databases can go down. Inputs can be stale, missing, or incorrect.

Your application defines how to behave when signals cannot be confirmed. That includes choosing fail-open or fail-closed behavior per use case.

SimpleStates emits stored facts only. It does not guarantee safety, correctness, or appropriateness for your domain.

• Founders who want deterministic primitives
• Teams who want to own outcome logic
• Engineers who prefer explicit boundaries over platform promises
• Builders who want facts they can inspect, compose, and explain later

If you want a plug-and-play access control system, SimpleStates is not that.

Self-hosted. Signal-only. No SLAs. No emergency support.