local-first · v0.1

Broker policy unresolved

Broker decision — HOW is this authorized request brokered? Fail-closed verification of the ApprovalToken, capability plan, BINDING policy allow, vault references, and scope binding. A single-use grant is issued only on brokered; it authorizes nothing to execute here — only the future Provider Execution runtime (V4) consumes it.

deniedbinding: trueno consumption0 vault refs#faa41bee
approval token:apptoken:appr-evidence-okbinding policy:policy:does-not-existcapability:capperm:emb-a-fs

Verification reasons (fail-closed)

policy_unresolveddeny
policy decision "policy:does-not-exist" does not resolve

Broker grant & provider handoff (V4 readiness only)

No grant — the request was denied (fail closed). Nothing to hand to the Provider Execution runtime.

Request inputs

execution reasonbroker brk-policy-unresolved
consumed approvalappr-evidence-ok
binding policy ref (M41)policy:does-not-exist
execution intent (M50)
brokered at ordinal100