Enforce eligibility at the shared creation boundary, not only automated discovery

Eligibility policy must be enforced at the shared persistence boundary across every intake surface that can create the same object. This applies when polling, dashboard lookup, API creation, replay, or reconciliation can all reach persistence: filtering only the automated discovery path leaves the other paths able to admit out-of-policy records. A manual override may intentionally use different rules, but that difference should be explicit, authorized, and auditable rather than emerging from a missing guard.

Method

For an unexpected record, distinguish discovery provenance from creation provenance. Correlate the exact create request and its preceding lookup, then trace which code path owns admission at persistence. Compare that path with the policy-enforced automated path and with the ticket that introduced each behavior.