feat(authz): bind decisions to exact actions

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81

schemas/decision_envelope.schema.json

@@ -14,12 +14,26 @@
     "matched_rule": {"type": "string", "minLength": 1},
     "resource": {"$ref": "https://flex-auth.netkingdom/schemas/check_request.schema.json#/$defs/resource_ref"},
     "subject": {"$ref": "https://flex-auth.netkingdom/schemas/check_request.schema.json#/$defs/subject_ref"},
+    "binding": {"$ref": "#/$defs/decision_binding"},
     "obligations": {"type": "array", "items": {"$ref": "#/$defs/obligation"}},
     "diagnostics": {"type": "object", "additionalProperties": true},
     "provenance": {"$ref": "#/$defs/provenance"},
     "caring": {"$ref": "#/$defs/caring_decision_metadata"}
   },
   "$defs": {
+    "decision_binding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["subject", "action", "resource", "request_digest"],
+      "properties": {
+        "tenant": {"type": "string", "minLength": 1},
+        "subject": {"$ref": "https://flex-auth.netkingdom/schemas/check_request.schema.json#/$defs/subject_ref"},
+        "action": {"type": "string", "minLength": 1},
+        "resource": {"$ref": "https://flex-auth.netkingdom/schemas/check_request.schema.json#/$defs/resource_ref"},
+        "context": {"type": "object", "additionalProperties": true},
+        "request_digest": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"}
+      }
+    },
     "obligation": {
       "type": "object",
       "additionalProperties": false,