Protect
Change it without breaking what people rely on.
Before a consequential change, Foundry establishes which behavior is verified, which is only observed or inferred, and what is still unknown. The risk is visible before the work starts.
Tell us about your systemToday: a repeated ref within 24 hours returns 409. Proposed: 1 hour. Who relies on the 24 hours?
- VerifiedMobile checkoutRetries a timed-out order up to 2 hours later with the same refMust survive
- ObservedPartner batch importRe-sends failed rows the next morningAt risk
- VerifiedWeb checkoutRetries within secondsUnaffected
- OpenArchive jobMay use ref to de-duplicate. Not confirmedResolve first
You recognize this when.
A change looks small and nobody can say it is safe.
The behavior you are about to alter may be load-bearing for a customer, a partner or another team’s batch job.
Tests cover what was intended, not what is relied on.
The suite passes. It never knew about the undocumented field three integrations depend on.
You will have to defend the decision.
An auditor, a customer or your own leadership will ask what you knew when you shipped it.
What you end up with.
Artifacts your engineers can use the same day. Each finding carries its evidence state. How we work.
Assess change impact
Know what a change, migration or replacement will affect, and which behavior has to survive it.
Delivered as: Change-impact assessment
Verify behavior
Repeatable tests confirm each finding. Anything not tested is labeled as observed, inferred or open.
Delivered as: Test suite · verification results
Watch for change
Re-analyze when a system or dependency changes, flag what moved and re-test what you rely on.
Delivered as: Change reports · compatibility checks
Who usually asks.
Security and architecture
Know what a system exposes before extending what can access it.
Engineering leaders
Make critical engineering decisions with fewer unknowns.
Engineers
Understand the behavior before you rebuild the interface.
Read more.
Discovery, verification and security assurance are three different things
What behavioral discovery establishes, what verification adds, and why neither is a security audit or a compliance result.
Why generated SDKs need conformance tests
Why an SDK generated from a specification can still be wrong, and what a conformance suite must cover before anyone builds on it.