Keep gateway identity assertions out of agent-visible schemas

A shared transport bearer authenticates a gateway service, not necessarily the end caller. If a trusted gateway injects a signed caller assertion as an internal tool argument, do not expose that argument in the agent-visible schema: exposure invites fabricated identities, while validating only the public schema may reject legitimate injected calls. Keep the public schema limited to user-supplied search fields, and validate the full internal argument set explicitly in the handler.

Before constructing a caller-scoped client, verify the assertion's signature, audience, expiry, and exact issuer-scoped subject, then retain the database's own grant checks. Test through real transport initialization, listing, and calls with interleaved actors, forged assertions, and unsigned requests, not only direct function tests. Local transport-to-source verification remains separate from proof that a shared route is deployed.