Whether a value is a well-formed principal-permissions projection: an
object whose permissions is an array of canonical identifiers and whose
policyVersion is bounded. Duplicate identifiers are tolerated rather than
treated as malformed — the consuming check has set semantics, so a host
that unions role bundles must not take an availability hit for a repeat
that cannot change any decision.
Both halves of the composed control run this predicate: the flowsafe host
validates resolver output before minting the projection, and the connector
gate validates the projection before trusting it. Anything else fails
closed.
Whether a value is a well-formed principal-permissions projection: an object whose
permissionsis an array of canonical identifiers and whosepolicyVersionis bounded. Duplicate identifiers are tolerated rather than treated as malformed — the consuming check has set semantics, so a host that unions role bundles must not take an availability hit for a repeat that cannot change any decision.Both halves of the composed control run this predicate: the flowsafe host validates resolver output before minting the projection, and the connector gate validates the projection before trusting it. Anything else fails closed.