I built a small Rust experiment for putting an authorization boundary in front of a protected action.
An authorization is tied to a specific action, resource, and payload. Once it's used successfully, trying to use the same authorization again is denied.
The repo includes the implementation, tests, and reproduction steps.
https://github.com/trencinodin-stack/arcstone-mcp-sidecar
I'm interested in edge cases or failure modes I've missed.
