Same system. Different outcomes.
Choose a scenario. All values are fixed examples evaluated in this browser; no API is contacted and no production data is used.
Valid request
An active member reads an invoice that belongs to their organization. The application checks ownership before returning the resource.
The gateway accepts the request contract. The application authorizes the object. The outcome is recorded without the invoice body.
Different tenant
A valid member asks for an invoice belonging to another organization. Authentication succeeds, but the object authorization check rejects the action.
A valid credential does not establish ownership. The request must not return the object or trigger a hidden downstream action.
Budget reached
An AI workflow proposes another model call after its allocated budget has been reserved or used. The executor pauses before starting new work.
The example requires a new budget decision instead of an automatic retry. Unknown usage remains unresolved rather than being counted as zero.
Keep each responsibility explicit.
Request boundary
Check the supported route, method, content type, and request limits. A request that passes this boundary still needs the appropriate application permissions.
Resource boundary
Use authoritative identity and resource context to decide whether this actor may perform this action now. Apply the same principle to nested resources and asynchronous work.
Execution boundary
Evaluate relevant tool scopes, approvals, and budgets before consequential work begins. A model proposal is not a completed action and does not create authority.
Evidence boundary
Connect the decision to the outcome without retaining unnecessary sensitive data. Keep failed or incomplete execution visible rather than merging it into a generic success.