Permissions

Worker A holds epoch 41 and pauses. The authority grants epoch 42 to worker B. The resource accepts B and rejects the resumed worker A.

Claude Code restarted. Its old MCP worker kept writing.

A replacement worker does not silence the old one. Fence stale MCP writes at the resource boundary before a resumed job overwrites newer work.

An agent writes revision 41, an engineer writes revision 42, and conditional recovery refuses to overwrite the engineer's repair

Claude Code rollback must not erase the next engineer's fix

A saved snapshot can undo the agent’s change and somebody else’s repair. Make recovery conditional on the revision the agent wrote.

Claude Code plans against resource version 41, but a state-bound write gate blocks execution after the resource changes to version 42

Claude Code approved one state. Its MCP write changed another

A reviewer approved a Claude Code change against resource version 41. By execution time, version 42 existed, but the MCP write replaced it anyway.

An allowed Claude Code CI retry passes through build and release systems before a fresh capability gate blocks production deployment

Claude Code had no deploy permission. Its MCP tool deployed anyway

A permitted CI retry reached production through an artifact event and a more powerful release service. Tool permissions missed the effect that mattered.

Claude Code's audit trail put the effect before the approval

Clock skew made an approved Claude Code run look unauthorized. Wall-clock timestamps cannot prove the order of a production agent’s approval, dispatch, commit, and revocation.

A Claude Code transcript passes through five independent evidence checks for identity, authority, durable effect, observation, and cleanup before a reviewer accepts the run

A Claude Code audit trail needs proof beyond the transcript

A Claude Code transcript can describe an MCP action without proving who was authorized, what committed, whether an independent read saw it, or what rollback left behind.

A Claude Code MCP write waits in a retry queue beyond its approval expiry, keeps the same operation ID, and is blocked by an execution-time authority check

Claude Code queued an approved MCP write. It ran after permission expired

A stable operation ID can stop duplicate MCP writes while still allowing an action after its approval expires. Recheck authority where the effect occurs.

A new Claude Code run is blocked because its pooled MCP session still carries the previous tenant context

Claude Code changed tenants. The MCP session did not.

A new Claude Code run selected the right tenant, but its pooled MCP session kept the previous tenant context. Bind every session to the authority it carries.

A Claude Code request for staging is blocked when the MCP gateway reveals that an adapter default would execute it against production

Claude Code asked for staging. The MCP adapter defaulted to production

A reviewer approved a staging MCP request, but the adapter filled an omitted environment with production. Authorize the normalized payload that will actually execute.

A revoked Claude Code permission is blocked when the MCP gateway compares a cached allow decision with the current policy version and revocation epoch

Claude Code lost permission. The MCP cache still said allow

Revoking Claude Code access is useless if an MCP gateway keeps serving an old allow decision. Bind cached authorization to policy version, resource state, and a short expiry.