Final rechecks
What the PEP checks again between ALLOW and execution, and why.
An access decision holds for the state in which it was made. If that state changes before execution, the decision loses its basis. This is the class of failure known as time-of-check to time-of-use: one thing is checked and another is used.
Xokepoint checks at three points:
The PDP already did its part before it returned ALLOW, by reading the effective permission revision again (Evaluation order). The PEP checks identity and catalog. The executor checks the catalog one last time, on the side that opens the connection to the server.
If any check fails, the tool does not run. The call is blocked, as if the decision had never left, and the agent can try again with the new state.
The executor calls the tool with the original name and arguments of the message. Nothing that the COAZ projection computed changes what is executed.