Authorizes one outbound call. Checks run cheapest-first and the rate budget is spent LAST, so a refused request never consumes budget. Every refusal is logged with the user id, identity id, reason and the masked destination.
The call being requested.
The policy, limiter and (optionally) the agent-permission check.
{Allowed:true}, or the refusal with a caller-safe Reason.
{Allowed:true}
Reason
Authorizes one outbound call. Checks run cheapest-first and the rate budget is spent LAST, so a refused request never consumes budget. Every refusal is logged with the user id, identity id, reason and the masked destination.