01 / The operating case
What changes in a real workflow?
A tools/call response says a firewall rule was applied, but the firewall service returns a timeout.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Emit tool-call ID, authorized argument digest, decision ID, downstream request ID and explicit unknown state; later query effective firewall configuration.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A successful JSON-RPC response is misread as proof that the firewall changed.
Evidence to retain
Keep correlation and observed state, redacting tokens and sensitive tool payloads.
04 / Canonical scope
Why this reference stands alone
Generic audit events define the taxonomy; this guide owns MCP-to-executor correlation.
Illustrative implementation artifact
MCP evidence join
tools/call.id -> decisionId -> downstreamRequestId
-> toolResult.id -> observationId
record tool schema hash and normalized argument digest
mark timeout as UNKNOWN until reconciledPrimary references