Component: PEP — Boundary adapters
Phase 5, "Not started" as of this writing. This diagram is the designed flow for the strongest of the four planned modes (resource-server mode); see Deploy a boundary adapter PEP for all four.
What it is (designed): resource-server / connector / mesh adapters that enforce at whatever boundary the integrator controls, when the agent itself is not modifiable.
What it does (designed): requires SDK-issued, per-call scoped tokens (and a transaction token for privileged calls) at the integrator's own boundary — building on the same PDP and verification helpers every other enforcement point uses.
Why "reduced-guarantee mode" must announce itself: not every boundary can support full
per-call verification (e.g. a legacy connector). The weakest designed mode — coarse outer
scoping plus revocation and edge audit only — is required to carry an explicit
guarantee_level field on every response and log line, so a reduced deployment is never
mistaken for full enforcement by whoever's relying on it.