# ADR-001 — Canonical authority context contract

**Repository:** gate-house  
**Status:** accepted  
**Date:** 2026-09-01  
**Workplan:** GH-WP-0001-T04

## Context

Gate House owns the vocabulary of an agentic authority request, while
access-engine is NetKingdom's only policy decision point. The surviving
`ArchitectureBlueprint.md` material named the required concepts, but left them
inside an obsolete canonical authorization-request example that also portrayed
Gate House as an in-path service.

Without a standalone contract, consumers can collapse identity roles, infer an
operating mode, treat caller-supplied context as verified fact, or implement
incompatible field meanings. Conversely, prescribing an access-engine API or
executable policy schema here would recreate the Staff/Engine boundary error
resolved by GH-DEC-2026-001.

## Decision

Gate House publishes
[`authority-context.v1`](../contracts/authority-context.md) as a logical claims
contract.

The contract defines eight claims:

1. principal;
2. actor;
3. runtime identity;
4. tenant;
5. environment;
6. mandate;
7. task;
8. operating mode.

It defines their meanings, source and binding expectations, mode-specific
requiredness, fail-closed conditions, evidence obligations, and versioning.

The contract is deliberately not a wire format, token, API, policy package, or
runtime resolver. Access-engine owns those representations and the
deterministic interpretation of the context alongside verified identity
claims, action, resource, approval, posture, and other policy inputs.

No field grants authority by being present. Caller assertion and authoritative
evidence must remain distinguishable, and security-critical resolution failure
fails closed.

## Consequences

- Access-engine has a stable semantic target without Gate House taking a
  runtime position.
- Identity, tenancy, zone, and mandate sources remain owned by their respective
  authorities; this contract only says what access-engine must be able to
  express and bind.
- Transport-specific schemas may differ, but their mappings must preserve the
  logical claims and invariants.
- New authorization-significant claims, modes, or semantic changes require a
  new contract version and Gate House review.
- The obsolete Blueprint example remains historical input until GH-WP-0001-T05
  revises that document; this contract is the current authority-context record.

## Alternatives rejected

### Publish a Gate House `/authorize` schema

Rejected because Gate House is Staff and holds no request-time position.
Owning an endpoint or executable decision schema here would contradict
GH-DEC-2026-001 and INV-02.

### Let each consumer infer the vocabulary

Rejected because principal/actor collapse, mode ambiguity, and unverified
caller context are precisely the semantic failures the doctrine must prevent.

### Put every claim into a credential

Rejected because credentials are implementation artifacts of authorization,
not the source of authority. The context need only remain linked across the
authoritative systems and decision evidence.