---
id: PIPE-6
family: RT-PIPE
level: core
profiles: [runtime]
posture: normative-target
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/rt-pipe/pipe-6
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# PIPE-6 — Authorization is decided before the handler, and travels with its cacheability

*RT-PIPE (Part II) · level: core · profiles: runtime · added in 1.0*

A response cached for one principal must never be served to another. That holds only if the authorization decision and the cache metadata describing what it depended on stay together.

## The rule

> **Normative.** This is the rule.
>
> 1. Authorization for a run's job surfaces is decided before the handler runs, and the decision's cache metadata travels with it, so a response cached for one principal cannot be served to another.
>
> 2. The decision is the entity's own authorization result, forwarded unchanged rather than reduced to a boolean; a handler must not re-implement a subset of the model, because doing so both locks out principals the surface admits and ignores extension points the model honours.
>
> 3. Authority over a job is not authority over a run: a run the caller may not view is refused before anything about it (its jobs, its summary, its label) is assembled.
>
> 4. Absence is answered before denial, so a request for an identifier that does not exist is `404` even where a caller holding the surface's authority could not have viewed it; this is a decided trade, and identifiers must therefore carry no information beyond their existence.

## Related rules

- Names: PIPE-5, SNAP-2
- Referenced by: SNAP-2

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.