---
title: "Do not issue authorization without exact policy binding."
description: "A full blocked flow where a server-issued synthetic DecisionCaseRef candidate exists but actor, session, and policy binding does not."
updated: "30 August 2026"
availability: "BLOCKED_CONTRACT · TEST_ONLY"
candidate_route: "/docs/raiffa/examples/sandbox-authorization"
---

# Do not issue authorization without exact policy binding.

A full blocked flow where a server-issued synthetic DecisionCaseRef candidate exists but actor, session, and policy binding does not.

**BLOCKED_CONTRACT · TEST_ONLY:** Owner policy lacks exact actor, session, and DecisionCaseRef eligibility mapping · no authorization · zero SQLite events · zero external effects

## Verify the blocked receipt stage by stage.

Read the fixed request and binding checks. This fixture stops before eligibility evaluation.

**EXAMPLE WORKBENCH:** BLOCKED_CONTRACT

### Input

INPUT / SERVER-ISSUED

- **Source:** credentialless descriptor
- **DecisionCaseRef:** opaque / present
- **Handle:** internal / non-serializable
- **Actor-session binding:** MISSING

### Checks

INTEGRITY / OWNER POLICY

- **Candidate pins:** manifest · exports · entry · runtime closure
- **Policy profile:** fixed / attested
- **Exact mapping:** NOT FOUND
- **Evaluation:** NOT STARTED

### Blocked receipt

RESULT / ZERO EFFECTS

- **Mode:** LOCAL_SIMULATION
- **Authorization issued:** false
- **Blocking code:** RAIFFA_SANDBOX_EXECUTION_AUTHORIZATION_POLICY_ACTOR_BINDING_MISSING
- **Effects:** 0 — consumption · SQLite · trace · dispatch · release

> **Authority:** NONE — No ELIGIBLE, MISSING_CONDITIONS, or INELIGIBLE state is invented.

## Discover server-issued fixture requests only

The example facade rejects caller-injected request payloads. It reads only credentialless descriptors from the pinned candidate surface, and treats handles as non-serializable internal identity.

> **LOCAL_SIMULATION:** No real user, login, customer case, external network, or deployment path exists.

## Stop at the exact missing policy binding

1. **Verify candidate integrity pins** — Check manifest, exports, entry, and runtime-closure digests first.
2. **Verify the owner policy plan** — Validate the fixed policy profile and attestation integrity.
3. **Look for actor and session binding** — The current owner-held plan has no exact candidate actor, session, and DCR eligibility key.
4. **Reject before evaluation** — Stop with `RAIFFA_SANDBOX_EXECUTION_AUTHORIZATION_POLICY_ACTOR_BINDING_MISSING`.
5. **Confirm zero effects** — Candidate consumption, SQLite write, trace, authorization, dispatch, and release all remain 0.

## The blocked state is the verified result

**Current boundary summary**

```json
{
  "mode": "LOCAL_SIMULATION",
  "classification": "TEST_ONLY",
  "authority": "NONE",
  "authorizationIssued": false,
  "blockingCode": "RAIFFA_SANDBOX_EXECUTION_AUTHORIZATION_POLICY_ACTOR_BINDING_MISSING",
  "externalEffects": 0
}
```

> **Interpretation:** Source and tests do not mean Sandbox authorization can be issued or is production-ready.

---

Published route: /docs/raiffa/examples/sandbox-authorization