gate-house/docs/adr/ADR-001-canonical-authority-context-contract.md

ADR-001 — Canonical authority context contract

Repository: gate-house
Status: accepted
Date: 2026-09-01
Workplan: GH-WP-0001-T04

Context

Gate House owns the vocabulary of an agentic authority request, while access-engine is NetKingdom's only policy decision point. The surviving ArchitectureBlueprint.md material named the required concepts, but left them inside an obsolete canonical authorization-request example that also portrayed Gate House as an in-path service.

Without a standalone contract, consumers can collapse identity roles, infer an operating mode, treat caller-supplied context as verified fact, or implement incompatible field meanings. Conversely, prescribing an access-engine API or executable policy schema here would recreate the Staff/Engine boundary error resolved by GH-DEC-2026-001.

Decision

Gate House publishes authority-context.v1 as a logical claims contract.

The contract defines eight claims:

1. principal;
2. actor;
3. runtime identity;
4. tenant;
5. environment;
6. mandate;
7. task;
8. operating mode.

It defines their meanings, source and binding expectations, mode-specific requiredness, fail-closed conditions, evidence obligations, and versioning.

The contract is deliberately not a wire format, token, API, policy package, or runtime resolver. Access-engine owns those representations and the deterministic interpretation of the context alongside verified identity claims, action, resource, approval, posture, and other policy inputs.

No field grants authority by being present. Caller assertion and authoritative evidence must remain distinguishable, and security-critical resolution failure fails closed.

Consequences

• Access-engine has a stable semantic target without Gate House taking a runtime position.
• Identity, tenancy, zone, and mandate sources remain owned by their respective authorities; this contract only says what access-engine must be able to express and bind.
• Transport-specific schemas may differ, but their mappings must preserve the logical claims and invariants.
• New authorization-significant claims, modes, or semantic changes require a new contract version and Gate House review.
• The obsolete Blueprint example remains historical input until GH-WP-0001-T05 revises that document; this contract is the current authority-context record.

Alternatives rejected

Publish a Gate House /authorize schema

Rejected because Gate House is Staff and holds no request-time position. Owning an endpoint or executable decision schema here would contradict GH-DEC-2026-001 and INV-02.

Let each consumer infer the vocabulary

Rejected because principal/actor collapse, mode ambiguity, and unverified caller context are precisely the semantic failures the doctrine must prevent.

Put every claim into a credential

Rejected because credentials are implementation artifacts of authorization, not the source of authority. The context need only remain linked across the authoritative systems and decision evidence.