Case Study: The Tool Set for Desk

This case study produces the complete tool set for Desk. The finished design makes four promises:

• No message can change whose data a tool returns, or raise the refund limit.
• Every failure of every tool has a message that names the next action.
• Every write carries a key, and every write has a stated autonomy level.
• No refund can be larger than the charge it returns.

It does not promise that the model always chooses the right tool, or that a refund the model describes really exists