Thanks — Part 2 is largely about this. The gateway doesn’t tag content; it makes content irrelevant to scope. Every call carries the scope this hop holds (delegated_read_groups / delegated_write_groups in the context), the depth-0 scope is minted from the entrypoint or task type — a summarize request mints read-only — never from anything the model read, and a request-scope forbid runs on every call. So a poisoned ticket can’t widen scope on a later call; the “close every Acme ticket” variant is denied by that forbid even though no tenant line is crossed. Part 3 narrows the scope per hop as agents hand off.

What’s left is the honest limit: the gateway bounds authority, not influence. Injected text can still steer the model toward a call that’s already in scope — read a different ticket Alice may read — so marking retrieved content untrusted at the model layer is complementary, and I’d run both.

On logging: agreed. Cedar returns the determining policy IDs with every decision; the post’s replays show tenant-isolation and request-scope by name, and a deny with a named forbid is exactly the line to alert on. Default denies have no name, which is why anything you care about is a forbid.