Authorize and Correct a Public Warning Across Evidence, Channels, and Jurisdictions

A public warning is a governed sequence, not a send button

A sensor crosses a threshold. A field observer corroborates it. An official decides that a protective action is warranted. A warning officer drafts a message. A supervisor approves exact language and geography. Several channels accept or reject different renderings. New evidence narrows the affected area. The public needs a correction.

Calling this sequence “send an alert” hides nearly every consequential boundary. Incident evidence, protective-action authority, permission to use an alerting system, approval of the exact message, technical submission, channel acceptance, device presentation, public understanding, and real-world action are different states with different evidence.

The use case is to keep that chain inspectable across time and jurisdiction: which accepted facts supported which exact message; who held the authority to approve it; which channel received which revision; what did each channel actually report; and how did a correction supersede rather than erase the earlier warning?

Grid can model the sequence, validate declared constraints, generate controlled channel projections, and retain explicitly authored channel request-and-response records when the configured integration returns them. Call one a runtime execution receipt only when it satisfies a documented receipt contract and binds captured runtime provenance. Grid cannot determine incident truth, confer legal or plan-based authority, approve a warning, certify a channel implementation, guarantee accessibility or delivery, or establish that a warning caused a safety outcome.

What official public-alerting sources establish

FEMA’s IPAWS signup guidance describes training, a memorandum of agreement, and a Public Alerting Application that defines requested alert types and geographic warning area, with review by the designated state official or tribal leadership. It also describes Alert-on-Behalf arrangements. Those steps establish system permission and scope; they do not by themselves grant substantive authority to order an evacuation, boil-water action, closure, or other protective measure.

FEMA’s IPAWS Best Practices Guide addresses policies, protocols, trained personnel, approval processes, cross-jurisdiction coordination, monitoring, message content, channel geography, updates, cancels, tests, and translation. The IS-247.C course is directed to authorized public-safety officials and covers appropriate, effective, and accessible alerts plus tests and exercises.

The OASIS Common Alerting Protocol 1.2 defines fields and semantics for alerts, updates, cancels, acknowledgments, errors, references, languages, times, instructions, and geographic areas. CAP can make a message relationship machine-readable. It cannot establish that the underlying evidence is true, the sender had authority, a member of the public received the message, or the instruction was understood.

The sources support a governable message lifecycle. They do not endorse Grid or make one generic workflow sufficient for every jurisdiction, hazard, plan, channel, or population.

Keep authority visible across jurisdictions

A public-warning model should not infer authority from a credential, job title, or urgent circumstance. The actual plan, law, policy, delegation, memorandum, system permission, and jurisdictional arrangement determine who may do what.

Responsibility	Required record	What it must not be confused with
Incident-evidence owner	Source identity, qualification, revision, observation and effective time, correction right	Authority to order a protective action
Protective-action decision owner	Jurisdiction, action type, basis, scope, delegation, effective interval, decision	IPAWS or vendor-system access
Alerting Authority or COG	Approved event types, geography, pathways, users, agreements, system status	General authority outside that scope
Exact-message approver	Identity, role, exact revision and hash, language/geography reviewed, decision and time	Approval of later material edits
Channel operator	Adapter profile, submission attempt, response, retry and acknowledgment	Proof of device presentation or public action
Neighboring jurisdiction	Its own protective-action and alerting authorities, or a documented Alert-on-Behalf arrangement	Permission inferred from shared geography

A cross-boundary polygon does not create cross-boundary authority. If an affected area includes two jurisdictions, the model should require the relevant approvals or a configured, reviewable arrangement. A user who attempts to include an unapproved jurisdiction should receive a blocked state with a precise scope explanation, not a warning that can be ignored.

Bind the warning to evidence and time

Every consequential fact needs more than a value. The model should retain the producing organization, person or device; source record ID and revision; observed and acquired times; effective interval; location and unit; qualification or conflict state; and any supersedes relationship. A normal laboratory result collected before a pressure-loss event cannot be used as if it described conditions after the event merely because it arrived in the same case file.

An alert proposal then binds to the exact accepted evidence revisions, geographic layer, template, model package, adapter profile, channel selection, language variants, and message hash used. Its authority record identifies the person and role, scope and basis asserted, exact proposal revision reviewed, approval, narrowing or rejection, time, and conditions. A material change to the source, area, event, instruction, language, timing, or pathway invalidates that approval and requires a new review under the configured process.

The model should keep observed at, acquired at, effective from, expires at, and submitted at separate. One timestamp cannot answer all of those questions. A later-arriving correction may govern an earlier interval; an expired message may remain essential audit evidence.

One authorized revision, many channel states

Wireless Emergency Alerts, the Emergency Alert System, the IPAWS All-Hazards Information Feed, websites, text services, social platforms, call centers, and local systems have different constraints and evidence. Channel-specific renderings should derive from one authorized semantic revision, but they do not have to be character-for-character identical.

Each projection should preserve the same source, hazard or event, location, protective action, and timing while declaring its channel profile and transformation. The receipt ladder remains explicit:

authorized → submitted → accepted or rejected → gateway logged → channel observed → test device presented → understood → acted

The FCC’s WEA and EAS order FCC 22-82 requires specified gateway logging by participating wireless providers and describes WEA’s predominantly one-way cell-broadcast architecture. Current 47 CFR § 10.500 describes downstream device behavior including authentication, monitoring, preferences, duplicate suppression, presentation, and preservation. It is therefore unsafe to label a gateway acknowledgment “delivered to the public.” That conclusion is an architectural inference; actual outcome evidence must be measured separately.

Correction is a new authorized act

A correction should identify the changed fact, cite the superseded message, produce a new exact revision, obtain the required authorization, use the appropriate original channels, and preserve both versions. FEMA’s IPAWS Tip 31 explains that a CAP Cancel stops repeated dissemination or removes an active feed item but does not itself communicate an all-clear to the public. A correction or ending instruction needs its own authorized public content.

The objective is not to hide that a warning changed. It is to make the correction as reconstructable as the original: what new evidence arrived, who accepted it, which consequence changed, who authorized the replacement, what every channel did, and which recipients acknowledged the new revision.

Language and accessibility are message integrity

An alert is not semantically consistent if one language names the East Zone and another names the West Zone, or if critical action appears only in an inaccessible linked image. Treat language, audio, and accessible presentation as governed projections with their own review and test evidence.

FEMA’s accessibility guidance recommends understandable language, minimal abbreviations, important information first, text-to-speech checks, audio consistent with text, and textual or audio explanations for images and maps. Tip 43 says critical details should be in the alert itself and linked content should be accessible to screen readers with alternatives for images. FEMA’s Spanish-language guidance states that IPAWS does not translate an alert and cautions against relying on automated translation without competent review.

Source, event, location, action, timing, and follow-up route should survive every variant. Qualified reviewers still have to judge the actual words. Supported languages and device or channel capabilities are versioned deployment facts, not assumptions that a model can fill in.

Exercise Harborline-27: a synthetic correction fixture

Everything in Exercise Harborline-27 is fictional and visibly labeled EXERCISE. Port Alder Water Cooperative, Harbor County, Kestrel County, source records, URLs, instructions, officials, geographic layers, and messages are invented. The example is not operational public-health guidance or a ready-to-send alert.

The exercise begins with these source states:

• At 08:10, synthetic source PRS-204 r17 records pressure falling from 58 to 12 psi; observed_at=08:10 and acquired_at=08:10:05.
• At 08:13, fictional field gauge FG-88 r2 records 14 psi and corroborates the represented pressure loss.
• At 08:14, LAB-771 r1 supplies a normal sample collected at 06:00. The model identifies it as pre-event evidence and blocks its use as proof of post-event conditions.
• Geographic source ZONE-EAST v12, effective August 1, includes Harbor East plus six blocks of neighboring Kestrel County.
• The exercise plans assign the protective-action decision separately to each county health officer. Harbor’s alerting scope covers Harbor only; Kestrel’s covers Kestrel only.

At 08:21, draft HBR-DRAFT r1 attempts to place both counties in a Harbor release. The jurisdiction check blocks it. At 08:24, revision r2 creates sibling Harbor and Kestrel packets, but the Spanish Harbor rendering says “West Zone” while the English rendering says East. Semantic parity blocks authorization.

At 08:28, a qualified exercise language reviewer corrects the zone. The two fictional health officers separately authorize the represented protective action. Their warning officers and supervisors then approve the exact hashes of HBR-001 r3 and KES-001 r3. The fixture’s English and Spanish messages are test data, not approved templates or translations.

The 08:30 channel evidence is deliberately mixed:

Channel attempt	Observed fixture result	Permitted conclusion
WEA adapter	Accepted at 08:30:04	The represented adapter accepted revision r3
EAS/IPAWS path	Accepted at 08:30:05	The represented path accepted revision r3
Exercise EAS receiver	Audio observed at 08:30:17	One designated test receiver observed the audio
All-Hazards Feed monitor	Revision observed at 08:30:08	One monitor observed the feed item
English county webpage	HTTP 201	The represented server accepted the English page
Spanish county webpage	Timeout	Spanish web handoff remains unresolved; retry is a new attempt

The overall state is partial handoff. It is not sent everywhere, delivered, received by the public, understood, or acted upon. The website retry remains tied to the same authorized semantic revision and exact language artifact; it does not justify editing the page after approval.

At 08:47, the fictional GIS owner publishes ZONE-EAST v13, correcting Kestrel’s affected area from six blocks to two. Version 12 remains immutable. Kestrel proposal KES-002 uses CAP message type Update and references KES-001; a seeded draft without that reference is blocked. The Kestrel authorities approve the new exact message at 08:52 and the update is submitted over the represented original channels at 08:53.

Replay must show that at 08:40, Harbor East and six Kestrel blocks were represented as active; at 09:00, Harbor East and two Kestrel blocks were active. The correction does not rewrite what the system knew or what officials authorized earlier.

At 11:05, new synthetic evidence and the responsible exercise officials end the instruction. A referenced CAP Cancel stops simulated retransmission, while a separately authorized follow-up tells the fictional public that the exercise advisory has ended. After 11:05, the model shows no active exercise instruction. A cancel record alone is never presented as the public explanation.

Failure modes that should stop the exercise

• Pre-event evidence is used to negate a later event without qualified interpretation.
• A credentialed user includes a jurisdiction outside the approved scope.
• A cross-jurisdiction release proceeds without the required authority or arrangement.
• English and translated variants disagree on location, action, or timing.
• A message is materially changed after its hash was approved.
• An adapter timeout is silently relabeled accepted.
• A gateway acknowledgment is reported as public delivery.
• An update lacks a valid reference to the message it supersedes.
• A cancel is presented as an all-clear without separate authorized content.
• A correction overwrites the original source, message, authorization, or receipt.
• A linked page carries essential action that is absent from the short alert or inaccessible in testing.
• An AI-generated summary invents a fact, changes geography, or strengthens an instruction.

Every seeded defect needs a predefined response: block authorization, reject submission, record timeout, request jurisdictional review, preserve both revisions, retry the same artifact, or require a new approved message. Urgency must not turn an unresolved state into an assumed answer.

A bounded public-warning evaluation

FEMA’s Homeland Security Exercise and Evaluation Program resources frame exercises around objectives, capability targets, critical tasks, observation, analysis, after-action findings, and improvement planning. CISA’s Ten Keys to Improving Emergency Alerts, Warnings, and Notifications emphasizes governance, interjurisdictional coordination, diverse pathways and populations, safeguards, templates, testing, documentation, and correction of misinformation. Those sources support a disciplined evaluation, not a product certification.

Run only in an approved test environment with synthetic or appropriately controlled fixtures. Name the actual plans, source owners, protective-action authorities, alerting scopes, message approvers, channel profiles, language reviewers, accessibility reviewers, evaluators, and stop conditions. Freeze the oracle before executing.

Test area	Minimum acceptance evidence
Provenance	Every critical claim links to a source ID, revision, observed and effective time; every seeded stale or conflicting fact is detected
Authority	Zero out-of-scope releases; each jurisdiction acts under its own recorded authority; every post-approval material mutation invalidates approval
Language and accessibility	Event, location, action, and timing remain semantically aligned; wrong-zone injection, text-to-speech defects, and inaccessible linked content are caught
Channel evidence	Every attempt records message revision, channel and profile, times, outcome, returned ID, error, and retry; no acknowledgment is labeled public receipt
Correction	Valid update references, preserved originals, new exact-message approval, and attempts over required channels are reconstructable
Cancellation	Every cancel references an active message; cancel-only state is not represented as an all-clear
Replay	Evaluators can reconstruct the active instruction at sampled times and identify what happened, when, where, from which source, with which outcome, and under whose authority

Outcome observations remain separate. Test-device presentation, surveys, call-center observations, web analytics, public understanding, protective action, and safety effects require their own methods. They cannot be inferred from a CAP record or transport receipt.

NIST SP 800-53 Rev. 5 supplies general audit, timestamp, audit-protection, and configuration-management control concepts that can inform evidence design. It is not an IPAWS-specific mandate, and applying it does not establish compliance or authorization.

Continue with Policy That Can Explain Itself for the wider public-decision chain, One Program Rule, Many Public Surfaces for semantic parity across outputs, and From Common Operating Picture to Common Operating Model for the architecture beneath changing facts and role-specific views. Use the decision evaluation worksheet to declare the exercise boundary before implementation.

The standard is not a fast send. It is a warning lifecycle in which evidence, jurisdiction, exact language, authorization, channel state, correction, and public outcome remain distinguishable enough that the responsible institution can explain what it knew, what it approved, what each system reported, and what changed next.