policy.entitlement.query

Thin read of an app's plan entitlement over subscription.*

Read whether an app's plan unlocks a given entitlement (GOV-8, thin read).

Inputs: actor, organization_uuid, identity_app_uuid, entitlement (required). entitlement is the planGate key a module/action declares (e.g. "operational"). Outputs: entitled (bool), entitlement, plan (nullable), reason, source.

v1 returns entitled=False with source="unwired" (fail-closed) — the actual read over subscription.* is a marked TODO (see module docstring / design §8). The contract is stable so callers integrate now and gain real plan data later with no change.

Overview

Property	Value
Workflow type	Atomic
Library	App-policy
Version	1.0

Input Schema

Field	Type	Required	Default	Description
actor	string	Yes	—	—
organization_uuid	uuid	Yes	—	—
identity_app_uuid	uuid	Yes	—	—
entitlement	string	Yes	—	—

Output Schema

Field	Type	Required	Default	Description
entitled	boolean	No	—	—
entitlement	string	No	—	—
plan	string	No	—	—
source	string	No	—	—
identity_app_uuid	uuid	No	—	—
failure_reason	string	No	—	—
failure_type	string	No	—	—
failed_action	string	No	—	—
failed_at_state	string	No	—	—
failed_layer	string	No	—	—
failed_step	string	No	—	—
error	string	No	—	—
error_type	string	No	—	—
reason	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "policy.entitlement.query",
  "initial_data": {
    "actor": "value",
    "organization_uuid": "value",
    "identity_app_uuid": "value",
    "entitlement": "value"
  }
}