Approve immutable content, authorize each execution context.

Approval stage

• Canonicalize a release manifest and hash the result.
• Record the exact content hash as the approval subject.
• Make approval state explicit and revocable.
• Reject renamed or mutated artifacts that no longer match.

Authorization stage

• Bind release, action, device, and controller configuration.
• Use a short expiry and single-use consumption.
• Re-check bindings locally immediately before dispatch.
• Deny on ambiguity or dependency failure.

Why the separation matters

Approval says that a specific artifact completed a review process. Authorization says that its use is allowed now, in this execution context. Combining them creates stale, overly broad permission.

Continue with the relevant guide

Try the local example without an application. For setup or integration help, you can also contact us.