Access Check Pipeline

Every access check — whether from an app or an agent — flows through a single evaluation pipeline. The decision returns synchronously. All side effects fan out asynchronously so they never add latency.

Key Design Decisions

• Synchronous decision — caller gets an answer in single-digit ms
• Async side effects — audit, telemetry, and webhooks fire after the response
• SQS fan-out — one event triggers all three consumers
• App and agent share one pipeline — tagged by source discriminator (app | agent)