real · implementation
Bearer credentials stay on the intended policy request
- Date
- 2026-10-18
- Track
- 2.0.0-alpha.1
The organization-policy client refuses HTTP redirects on bearer-authenticated requests before a credential can be forwarded to another location.
Accessible description: A bounded policy request flow ending at a redirect refusal boundary
Boundary
This is public code-side qualification, not hosted entitlement, customer acceptance, or independent AppSec review.