Component: PEP — Sidecar
What it is: a local egress proxy, one per agent process, that intercepts the agent's outbound calls on localhost.
What it does: calls the PDP, swaps the presented token for a narrowed one, and either forwards or blocks — there is no third outcome, and forwarding is reachable from exactly one code path.
Why it can't be bypassed: forwarding is reachable from exactly one place in
sidecar/enforce.py — there is no second code path from an inbound request to the upstream that
skips decide → exchange. Any failure anywhere in that sequence (PDP unreachable, exchange
unreachable, a malformed decision body) is a 503 with zero requests reaching the upstream —
fail-closed, never a degraded pass-through.