I built a small Rust experiment for putting an authorization boundary in front of a protected action.

An authorization is tied to a specific action, resource, and payload. Once it's used successfully, trying to use the same authorization again is denied.

The repo includes the implementation, tests, and reproduction steps.

https://github.com/trencinodin-stack/arcstone-mcp-sidecar

I'm interested in edge cases or failure modes I've missed.