---
id: RT-GATE-3
family: RT-GATE
level: core
profiles: [runtime]
posture: normative-target
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/rt-gate/rt-gate-3
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# RT-GATE-3 — Consent binds to the node and its exact resolved arguments

*RT-GATE (Part II) · level: core · profiles: runtime · added in 1.0*

The operator approved one call, not "this node from now on". If the arguments drift, the approval no longer describes what would happen.

## The rule

> **Normative.** This is the rule.
>
> 1. A consent binds to a hash over the node identifier and its canonicalized resolved arguments: keys sorted, scalars encoded stably, and internal parameters (those whose names carry the reserved `__` prefix) excluded.
>
> 2. Any mismatch between the hash a consent carries and the hash of the call at hand is treated as no consent: the gate asks again and must never reuse the earlier consent.
>
> 3. Where a question is still pending for arguments that have since drifted, it is withdrawn before the new one is asked; where a question is still pending for the same call, that question is re-raised rather than duplicated.


## What it means

A pending question is not safe from being replaced by a later one for the
same node. Where the arguments have drifted since the question was raised,
the earlier question is withdrawn before the new one is asked — an operator
who has not yet answered never sees a question about a call that no longer
matches what would actually run. Only a question for the identical call is
re-raised as itself rather than duplicated.

## Example

A question already waiting in the inbox, for arguments that no longer match
the call at hand:

```json title="The pending question already in the inbox" verdict="withdrawn"
{ "message": "old args" }
```

```json title="The call that arrives instead" verdict="paused"
{ "message": "send it", "level": "info" }
```

## Related rules

- Names: RT-GATE-1, RT-GATE-2, RT-GATE-9, RT-GATE-12
- Referenced by: RT-GATE-1, RT-GATE-2, RT-GATE-5, RT-GATE-9, RT-GATE-12

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.