Rotate the policy gate signing key

The organization: its uuid, or its slug. One you are not a member of is a 404.

The space: its uuid, or its slug within the organization. An id further down the path that belongs to a DIFFERENT space is a 404, not a cross-space read.

API version negotiation. Send forumulate-version: 2027-03-01 on every request from a new integration; it is optional only so that integrations written before versioning keep working. Each version includes everything before it:

Makes this write safe to retry. Optional — send any unique string (a UUID is ideal) and the first request runs while its response is remembered under that key for 24 hours; an identical retry replays that same status and body instead of acting twice, so a timeout or a 5xx from the edge can be retried without creating a second row. A retry sent while the first request is still in flight is refused with 409. The key is scoped to the method and path, so the same key on a different endpoint is a different request. Error responses of 5xx are never cached — those retries re-run. A key is bound to the BODY it was first used with: reusing it with a different body is a 409 idempotency.key_reused, not a replay, because replaying would tell you a write landed that never ran. Generate one key per request, never per process or per session.

true: authenticate, authorize and validate this request (body, query and path), then answer 200 {dryRun: true, ok: true, operation, checks} WITHOUT carrying it out — nothing is written, queued, mailed or announced. It does not compute a diff, and a write that passes may still be refused by a state check at write time (a slug taken in between). Anything other than true/false is a 422.