01 / The operating case
What changes in a real workflow?
An incident agent can isolate host H-7 through a tool wrapper and through a direct endpoint API.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Normalize verb and immutable host ID, request a decision immediately before execution, bind the result to those values, and block both routes on DENY or unavailable authority.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
The wrapper enforces policy but a direct API call uses the same cloud credential without interception.
Evidence to retain
Compare PEP decisions with endpoint API invocations; investigate every unpaired operation.
04 / Canonical scope
Why this reference stands alone
Policy-decision-point implementation computes a verdict; this guide owns where and how to enforce it.
Illustrative implementation artifact
PEP boundary test
for path in [toolWrapper, directApi, queuedWorker]:
attempt delete(customerId) without task grant
assert path returns DENY
assert customer state unchangedPrimary references