Recheck authorization when restoring a legacy disclosure path

When optional integration data selects between a gated disclosure path and a legacy display, changing the selector also changes which authorization checks execute. Trace both branches before restoring the legacy display. A proof token can establish identity or evidence without checking whether the current record is hidden or belongs to the same organization as its parent. Enforce those current-state checks on the branch that actually returns the sensitive value, and exercise valid-proof cases with hidden and mismatched records. Scope the correction to the affected integration when other integrations must preserve behavior.

Applies when: optional data activates a new flow while absent data retains legacy disclosure. Keywords: authorization legacy fallback disclosure proof token hidden organization integration