Execution and response
After ALLOW, the PEP checks again what may have changed, calls the tool with the right credential and returns the result.
A few milliseconds pass between ALLOW and execution, and something can change in that window: the identity connection can be disabled, the token can expire, the administrator can approve a new server revision. The PEP does not execute a decision made on a state that no longer exists.
The final rechecks close that window. Upstream authentication explains which credential Xokepoint uses for each kind of server, and why it never forwards the agent token. The response shows what returns to the agent.