Verify every authorization gate before granting scoped access
An allowlist entry can be saved successfully while the requested access remains denied when a gateway and leaf service enforce separate authorization gates. For an MCP integration with per-user signed identities, trace both request rewriting and the leaf's final predicate before …