I built a small Rust experiment for putting an authorization boundary in front of a protected action.An authorization is tied to a specific action, resource, and payload. Once it's used successfully, trying to use the same authorization again is denied.The repo includes the implementation, tests, and reproduction steps.https://github.com/trencinodin-stack/arcstone-mcp-sidecarI'm interested in edge cases or failure modes I've missed.