Fields on CreateApprovalInput that select CAPABILITY or ATTRIBUTION, and so
belong to the trusted computing base alone (security-threat-model.md, trust
boundary 6). A request body that names any of them is rejected outright:
connectors IS the minted grant — an approved record's connectors become
the requestContext grant the write gate checks.
grantScope is persisted capability metadata. It is record-only, but is
named here so an attempted body field is rejected rather than ignored.
toolCallId narrows a durable-agent grant to one persisted tool call.
runScoped turns a step-less record into a standing grant on every leg.
stepPath, suspendedAt, resumedAt, resumeCount select WHICH leg a
grant mints on. Rejecting connectors alone is insufficient because a
future trusted merge must never inherit client-selected identity.
requestedBy is the field decide()'s separation-of-duties check compares
against; spoofing it lets one principal approve their own request.
requestedByKind distinguishes a human requester from automation with
the same id and is therefore equally trust-sensitive.
Fields on CreateApprovalInput that select CAPABILITY or ATTRIBUTION, and so belong to the trusted computing base alone (security-threat-model.md, trust boundary 6). A request body that names any of them is rejected outright:
connectorsIS the minted grant — an approved record's connectors become the requestContext grant the write gate checks.grantScopeis persisted capability metadata. It is record-only, but is named here so an attempted body field is rejected rather than ignored.toolCallIdnarrows a durable-agent grant to one persisted tool call.runScopedturns a step-less record into a standing grant on every leg.stepPath,suspendedAt,resumedAt,resumeCountselect WHICH leg a grant mints on. Rejectingconnectorsalone is insufficient because a future trusted merge must never inherit client-selected identity.requestedByis the field decide()'s separation-of-duties check compares against; spoofing it lets one principal approve their own request.requestedByKinddistinguishes a human requester from automation with the same id and is therefore equally trust-sensitive.