The proposed action carries a declared principal, purpose, target, policy version, owner, and grant source into a policy-controlled decision.
The public website simulation and the cited immutable public source snapshot.
The simulated application normalizes an intended tool call into a proposed-action envelope before the 5D boundary. Deterministic policy evaluates the declared action, identity context, policy owner, and grant source.
Optional semantic evidence can make a route stricter or provide context. It cannot clear a deterministic block.
Deployment coverage, identity validation, policy correctness, reviewer identity, and executor wiring remain responsibilities of the integrated system.
In the website composition, semantic evidence and reviewer input are recorded inputs; the policy path resolves the terminal disposition.
Interactive demonstration · Evidence: website-action-flow, public-policy-sourceLimit: This verifies the public simulation and cited code boundary, not a deployed customer integration.
A reviewer can accept or reject a declared exception on a policy-selected branch, but the reviewer record does not independently authorize execution.
Interactive demonstration · Evidence: website-action-flowLimit: No live reviewer service or approval channel is represented.
The website does not authenticate a real principal, load a production policy, or execute a tool call.
An identity claim is not proof that the identity was cryptographically validated.