01 / The operating case
What changes in a real workflow?
A workflow engine can identify the task but only a cloud API sees the final instance target; both facts are required to authorize a termination.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Map the full call graph, identify where each fact becomes trusted, and place the final allow/deny before the cloud operation. Test direct SDK, queued job and retry paths for the same policy.
03 / Failure and evidence
What goes wrong, and what can be proven?
A model-side check approves a vague “maintenance” plan, then the executor receives a different instance or operation and acts under that old approval.
Keep call-graph version, trusted context source, request digest, enforced decision and cloud operation ID for each path.
04 / Canonical scope
Why this reference stands alone
PEP bypass analysis tests missing paths; this page owns the positive choice of boundary and the trusted-input inventory.
Implementation review
Trusted-input placement
Workflow: signed-in user and task origin. Tool handler: normalized operation and arguments. Cloud API: final target, resource state and effect. Carry verified context to the last non-bypassable boundary.
Adversarial check
Change the cloud target after tool approval or call the API through a second route. Both should reveal whether the chosen boundary saw the true request.
Primary references