01 / The operating case
What changes in a real workflow?
A billing agent calls a payment API through a gateway, but a batch worker uses a private endpoint.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Authenticate workload, validate audience, extract target and amount where safely possible, query current authority, and force all payment paths through equivalent enforcement.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
Gateway coverage is assumed universal even though a direct private route remains.
Evidence to retain
Reconcile gateway decision IDs with payment API transaction IDs.
04 / Canonical scope
Why this reference stands alone
Tool wrappers operate before transport; this page owns routed API policy and topology.
Illustrative implementation artifact
Gateway coverage proof
protected API routes = enumerate network and private paths
for every mutation route: require authenticated principal
+ trusted task context + decision binding
reconcile API write IDs with gateway decision IDsPrimary references