Authorize the action, then grant access

Authorize the action, then grant access A sequence diagram generated by Archify. Identity + delegation + request proof When required: request approval Approve or deny Authorized scope or rejection Continue only if policy and anyrequired approval allow theaction. Path A: policy-aware request Alternative A: the resourcevalidates authority at runtime.Skip path B. Path B: target credentials required Short-lived scoped credential Authorized target operation Alternative B: use broker-issuedtarget access instead of path A.Scope and lifetime remainbounded. Agent · Workload identity · Sequence participant Agent Workload identity Resource / policy · Runtime decision · Sequence participant Resource / policy Runtime decision Human · High-risk approval · Sequence participant Human High-risk approval Credential Broker · Target-specific access · Sequence participant Credential Broker Target-specific access Target service · Enforce scope · Sequence participant Target service Enforce scope Legend main request return security