Engineering note
What an admission decision actually proves
A signed permit is a scoped claim about one action, not a general statement that an actor is trusted. Reading the scope and replay state correctly.
The point of an independent admission authority is that the component executing an action does not decide whether the action is allowed. Gatekeeper evaluates its requirement gates and issues a permit only when the gates it needs are established — or it refuses with a specific reason.
A permit is not a generic approval. It is scoped to the approved action and its context, carries an expiry and is verified again at the execution boundary. A permit that cannot be verified is not permission.
What the permit binds
- The approved action, so an altered payload cannot ride on an earlier approval.
- Its scope, so a permit cannot be reused across boundaries.
- Expiry and single-use state, so a captured permit does not become a standing capability.
- The decision record, which the audit chain links to execution and outcome evidence.
What the decision does not prove
An admission decision does not prove the executor succeeded, that the external system changed as intended, or that the outcome conforms to the original intent. Those are observation, reconciliation and conformance questions, handled later in the lifecycle.
The reviewed implementation also has boundaries a reader should know: its signing and identity configuration are simplified, external identity federation is not configured, and live network admission is blocked while policy context is unobserved. The admission path is integrated in the bounded local chain; it is not production-qualified. The internal mechanism is not published here.
Why the separation matters
Collapsing admission into execution makes the executor the authority over itself. Keeping them separate lets the platform answer three distinct questions with three distinct records: was the action permitted, did it execute, and did the outcome conform?