- Shipped
- November 6, 2026 at 10:45 PM UTC
- Author
- Kamo
- Commit
- 3ff5f46
PolicyDecisionPoint answers every authorization question the Tool Plane pipeline asks, in the same order: visibility + rights floor, No Insubordination order and on-behalf chain of command, meeting speaker authority, conditional rights, charter FORBIDDEN and outcome (CharterPolicy.explain names the rule, incl. 'Approve and always allow' standing permissions), the identity guard and what lifts it, approvals. Each call's audit row carries one kamo.si.decision/v1 record (decision_record / decision_outcome / decided_by), readable through the existing I2 audit read and /audit/decisions/{id}. Meeting lines are read once per call (identity guard, order, on-behalf shared one read). Behavior unchanged: the golden files from b64fb8a (charter matrix, catalogue, 360 scenarios) all match.