2AYE Enforce / Shared platform capability
A decision becomes protective only when the destination refuses changes without current, exact authority.
Part of Authorize and Evidence. This capability guide introduces no separate product, subscription, or universal integration claim.
Existing reference receivers check bound parameters, expiry, replay, and current authority. The disposable reference credential destination couples redemption, the version change, signed effect evidence, receipt, and audit in one transaction.
The credential reference requires shared PostgreSQL and stable signing keys outside Development. It does not establish an externally operated receiver without issuer database access, universal customer-hosted enforcement, or exactly-once remote effects.
Use case / Protected-service engineer
Illustrative integration review. These controls explain the design; they do not submit requests, grant authority, or execute an action.
Stage 1
Apply an authorized versioned credential change.