How does BeforeQuery prevent unauthorized actions?

Unauthorized actions are prevented at four layers, in order.

First, the requester's identity. The Assistant reads who is asking from the channel: SSO in Slack, Teams, and Discord; a signed cookie on the widget; an MCP token in Claude Desktop or Cursor; a workspace API key in the SDK. Anonymous requesters cannot invoke write actions at all.

Second, the ownership check. When an action would touch a specific record — an order, a subscription, a user account — the identity input pattern binds the record to the requester's verified email or user ID. The model can never fill an identity field; the framework injects the caller's own ID. If the requester does not own the record, the action returns ErrNotOwner before it starts.

Third, the approval policy. Read actions default to autopilot. Write actions default to require an approval. Destructive actions default to require a step-up MFA challenge on the reviewer. Policies configure once and reference from any playbook.

Fourth, the audit log. Every action execution — approved, rejected, or auto-run — writes an immutable row: actor, action, target entity, before/after state, IP, timestamp. Nothing writes to your systems without leaving a trace.