Gate check

Venue-facing read: allow or deny this action for this subject now. Missing, expired, failed, or timed-out reads are denies.

Maturity: Contract-preview until Early Access / production consume is marked Live. Fake gate is valid for eng verification.

Outcome

Capability	What it gives you
Single gate call	One answer before quote / settle / hold
Fail-closed	No silent allow when Cleared or cache is unhealthy
Policy binding	Response carries `policy_version` when allow

Gate does not return vault documents, bureau names, or screening narratives.

Contract

POST /v1/gate/check
Authorization: Bearer clr_…
Content-Type: application/json

{
 "subject_ref": "subj_synth_001",
 "action": "quote",
 "as_of": "2026-10-03T15:00:00Z"
}

Allow (synthetic):

{
 "allowed": true,
 "action": "quote",
 "policy_version": "pol_v0.1.0",
 "stratum_record_id": "stratum_rec_synth_abc",
 "expires_at": "2026-10-10T00:00:00Z"
}

Deny (synthetic):

{
 "allowed": false,
 "action": "quote",
 "reason_code": "no_live_pass",
 "retryable": false
}

Public reason_code values (illustrative): no_live_pass, expired, action_not_allowed, decision_not_pass. Judgment detail is not exposed.

Fail-closed rules

Integrators MUST deny the business action when any of the following occur:

allowed: false
HTTP 403 / 422 with gate denial body
HTTP timeout or connection failure
HTTP 5xx from Cleared
Response missing required allow fields when claiming allow

Do not cache “last allow” across expiry. Do not treat optional outsider prove downtime alone as deny if Stratum-only degrade applies and Stratum live-pass is present — quote SoR is Stratum. Missing Stratum live-pass is always deny.

Latency

Early Access target: p95 gate read from live-pass cache < 200 ms under issued SLOs. Cache miss that cannot be resolved in budget → deny (not “try quote anyway”).

Wiring checklist

Gate called before quote (and other gated actions)
Deny path returns venue 403/422 (or equivalent) to the quoter
Timeouts mapped to deny
Metrics: eligibility_checked, gate_denied (or your equivalents)
No vault or PII logged from Cleared responses
Production Checklist reviewed