Execution boundary

Gate ROS 2 dispatch on the exact approved policy release.

A release gate checks immutable policy identity, approval state, device configuration, and a short-lived authorization before the local system can send a controller command.

Request a Shadow Audit

What the gate binds

Release and content hashes, not a mutable model name.
The intended robot, controller configuration, and action.
Current approval and revocation state.
A short-lived, single-use permit consumed at the dispatch boundary.

Fail-closed behavior

Unknown releases, mismatched configuration, expired authorization, revocation, and control-plane errors must deny the operation. The final decision remains local to the robot-side gateway.

Adoption path

Describe the current artifact-to-dispatch sequence.
Create a canonical release manifest and compute its content identity.
Insert checks immediately before the existing controller call.
Exercise allow and deny paths in simulation before hardware use.

Continue the architecture review

Ready to map the release path? Request a Shadow Audit.