A service boundary accepts valid traffic but mishandles duplicate, stale, or unauthorized records. The affected area is permission policy.
Repair the permission policy runtime configuration implementation so it applies documented precedence and reports unsupported keys.
Evidence
- Affected surface: Django / permission policy.
- Observed failure family: merge layered configuration.
- Scope policy: authorized must equal true.