Ideas · Builder Notes
Approvals bound to the exact request, and spent once
In Kognita alpha a human approval now binds to the exact request, is spent once, and re-checks credentials, sandbox and screening on release.
Approval continuations could be replayed, reused for a changed request, or released without the checks an immediate allow gets.
An approval binds to the envelope hash, plus the request body hash at the gateway, and is spent once transactionally. Signers must be named and distinct. Resumed releases rebuild sandbox constraints, re-check the credential by digest and re-run screening. Held gateway calls get a durable single-use continuation. An older grant cannot bypass a pending hold.
A blank citation can never allow; it escalates. Approvals became one-use, exact-request and re-checked.
Approval flows are now strict, which may feel heavy for low-risk use cases.
Take this with you
An approval is for a specific thing at a specific time. Bind it, spend it, and check again on release.
Sources
Kognita is an open-source alpha. This note comes from Kognita PR #69, Kognita PR #78, Kognita PR #88, Kognita PR #93, Kognita PR #104 in the Kognita repository.