Skip to main content
A request may contain material that is valid inside one application but restricted when sent to a provider. Gateway must respect both the content selected for the request and the permission to disclose it. For governed Context profiles, those facts come from their owning components. Gateway must not invent a parallel memory store or grant itself permission from a request field.

​
Context selects the material; authority permits its use

Context supplies the applicable source material, revision, currentness and disclosure conditions. Authority and Warrant supply the current grants for the relevant actor, purpose and operation. Credential and egress controls establish the authorized destination and means of access. A package identifier or digest can identify data. It does not prove that the sender was authorized to create the package or disclose its contents. These controls are cumulative. A compatible model, a valid credential and an authenticated caller still need to satisfy the applicable data-handling restrictions together.

​
An illustrative region restriction

Suppose a task may send selected source material to an approved provider in one region. The first offering becomes unavailable. A recovery action cannot quietly move that material to another region simply because the alternative is healthy. The alternative must preserve the request’s applicable provider, region, handling and quality restrictions. No eligible offering and temporarily unavailable capacity are different reasons to stop.

​
Seal the final model-visible input

Under the governed contract, permitted shaping instructions—such as system content and output constraints—are resolved before the final package is sealed. Gateway must then use the accepted final content and token/window handshake. It may not trim the input, add a hidden instruction or make a model-visible serializer change after sealing. A mismatch is not a harmless formatting adjustment. The disclosure record associates the actual provider-visible bytes with their package, snapshot and selected handling context. It is not a replacement for the original grant or for current receiver checks.

​
Permission must still be current at the effect

An old object or cached grant is not perpetual authority. The applicable validity, revocation and recipient restrictions must be checked when an effect is about to occur. A provider credential authorized for one tenant or target cannot be reused for another merely because the same adapter can reach both. Nor may an untrusted request override its authenticated caller scope.

​
Keep content out of the execution ledger

Gateway’s O1 history records content-free execution facts and references. It is not another prompt, answer or private-reasoning archive. Content retention remains with the relevant Context, application or artifact owner under its own policy. The selected design includes these governed interfaces, but the source evidence does not establish that every ordinary text call already traverses a production-qualified Context path. Missing a required genuine supplier prevents activation of that protected path; it does not justify a permissive stand-in. Read Security and privacy in practice and Who owns what for the adjacent boundaries.