# Enforcement boundary

**Default mode:** enforce (hosted /fabric/status reports `mode: enforce`). Some stages are off by default: `intent` (records intent, breaks legacy callers if required) and `approval` (human-in-the-loop hold off by default). 'Enforce mode' is the master switch, not every stage.

**Consensus path:** each recorded decision is ordered through the live PBFT cluster; no quorum commit -> deny (fail closed). A quorum-certified authorization snapshot path also exists for cached authorization; it is a different measurement boundary from fresh consensus.

**What the boundary covers:** a tool call routed through MCPGate runs only with an authorization. **What it does not cover:** calls that bypass the gate. Boundary enforcement is opt-in; an agent that can reach an equivalent tool outside the gate is not governed.

**Bypass-resistance demonstrations (allowed succeeds; denied does not reach the tool; changed params rejected; direct access blocked; replay rejected; revoked authority rejected; cross-tenant rejected; delegation cannot widen; restart preserves replay protection; dependency failure fail-closed):** **NOT ESTABLISHED** in this package. They require an isolated demo environment and explicit operator approval and were not run against production.