Version boundary
Pin API/schema/profile versions in test evidence.
DEVELOPER GUIDEREFERENCE CONTRACT
Authentication & Authorization
Use OAuth/OIDC patterns where applicable, scoped tokens, purpose and mandate context; never conflate AuthN, AuthZ and field disclosure.
CONTRACT PRINCIPLES
The protocol carries business semantics.
Each integration must preserve authority, policy, evidence and recovery context.
Correlation
Carry a correlation ID across request, event, connector and evidence records.
Idempotency
Protect material write operations from accidental replay.
Authority context
Never infer legal authority solely from transport success.
AUTHN ≠ AUTHZ ≠ DISCLOSURE
Identity proof is only the start.
Tokens establish session/client context; PDP decisions and disclosure composition determine what can be done and seen.
01REQUESTIdentity · Resource · Purpose
02PIP CONTEXTRole · Mandate · Attributes
03PDP DECISIONPolicy · Lawful basis · Risk
04PEP ENFORCEMENTAllow · Deny · Mask · Constrain
05COMPOSED VIEWPermitted fields only
ARCHITECTURE WORKSHOP
Move from integration to evidence-backed approval.
Align product-group applicability, authority boundaries, portal journeys, integration contracts and evidence before committing to production claims.