Resolve user notification preferences

Compute candidate channels and separate action-delivery policy; Notify-only defaults require trusted service identity, and resolution executes no delivery.

Outcome

Compute candidate channels and separate action-delivery policy; Notify-only defaults require trusted service identity, and resolution executes no delivery.

These examples prove local handler behavior with real isolated notification SQL and explicitly simulated identity dependencies.

Before you start

Verify pinned identity, the exact action and intended organization/user. Organization policy requires its manager/platform authority; user policy permits self/platform or organization management. Ordinary preference resolution for another user requires platform authority, not organization admin alone.
Before a whole-scope replacement capture complete prior semantic settings, including disabled rules and JSON objects. Review intended wildcard dimensions and effects. Empty rows clears that explicit scope; replacements are sequential, can fail partially and always create new rule ids.
Ordinary user resolution must omit Notify-only default_channel/transactional. Separate local service-context captures prove real ephemeral Notify signature checks, not a public gateway transport or live service credential. Do not copy service-only inputs into user OAuth calls.
Stored policy, candidate channels, resolved delivery mode, actual Notify dispatch/receipt, timers and application action approval are separate outcomes. This family sends no messages and performs no application action.

Discover the target

topolo whoami --json
topolo apps --json
topolo actions get app_topolo_auth.user_notification_preferences.resolve --detail --json

Discover intended exact organization/user. Read organization_notification_action_policy.list and user_notification_action_policy.list for their separate scopes, plus ordinary global/organization preferences and stored channel flags. Resolve a specific actual producer/event/surface/category/priority context without Notify-only defaults on user OAuth.

Input fields

Field	Required	Meaning
`userId`	Yes	Exact intended Auth user from authorized discovery. User action-policy storage allows self/platform or management of orgId; ordinary preference resolution allows self/platform, not organization manager alone for another user. Neither a known user id nor rule id grants authority.
`org_id`	Yes	Required exact organization scope for computed preference resolution. It is a query field, not an override of authenticated user authority; discover the intended organization rather than infer membership from a successful stored-scope read.
`event_type`	Yes	Specific two-to-four-segment lowercase event type, or * in a stored policy row. Resolver requires a specific event and refuses . Stored row omission becomes .
`source_app_id`	No	Source application matching dimension: * wildcard or a 1–128-character discovered canonical id/slug using letters, digits, dot, underscore, colon or hyphen. Row omission defaults to . Resolver omission matches its context; keep the actual event producer identifier consistent.
`surface`	No	Stored notification/action surface or * wildcard; omitted row value becomes *. Resolver uses notification by default and accepts notification/action only. This describes delivery policy, not permission to execute an application action.
`category`	No	Matching event/action category string (same bounded dimension syntax) or . Stored omission and resolver omission use . Use the producer contract category rather than invent a label.
`priority`	No	Matching event/action priority string (same bounded dimension syntax) or . Stored and resolver omission use . Priority matching does not independently bypass delivery/approval rules.
`default_channel`	No	One channel or 1–5 unique channels from the owning event contract. Only a cryptographically trusted TopoloNotify service invocation may supply it. User OAuth, API input or organization authority cannot manufacture this trust; omitting it on ordinary user resolution supplies no event defaults.
`transactional`	No	String true or false permitted only for the cryptographically trusted TopoloNotify service. Notify must supply an explicit value even if default_channel is omitted. true selects only contract defaults and bypasses preference/organization clamps in Auth; dispatch and receipt remain separate. Ordinary user resolution must omit this field.

Effects

Reads preference/policy/address/core timezone state and computes candidate channels plus a separate action-delivery policy.
Performs no message delivery, ownership challenge, digest assembly, scheduling, application action or approval.

Interpret the response

Computes candidate channels from the eight-step organization/global/event/channel preference ladder, followed by event defaults supplied only by trusted Notify. Ordinary user calls supply no event defaults. Nontransactional organization forbids clamp the candidates.

Addresses come from stored verified flags, selecting primary-email-source rows preferentially or the most recently verified address; in_app needs no address. Missing verified address drops a candidate and records no_verified_address. These flags are separate from actual ownership and delivery.

Enabled matching user action policies outrank organization rules (user score 100 plus exact matches). Within a scope more exact dimensions score higher; equal-score tie ordering is not a documented stable latest-wins rule. Disabled rules are ignored. A matched muted/required_action true returns in_app_only; default policy is immediate with matched_rule null.

The computed channels array is separate from policy_resolution delivery_mode. For example channels may include email while muted/required-action policy resolves to in_app_only; actual Notify dispatch enforcement is a later step. Quiet/digest/escalation objects are returned without creating timers, messages or actions.

Only a real trusted Notify service may pass default_channel/transactional, and it must provide explicit transactional true or false. true uses defaults and bypasses preference/organization clamps in Auth. Other signed services and user OAuth cannot request that boundary. User timezone comes from core metadata; lookup failure yields null, not proof of UTC or valid scheduling.

Worked examples

These are complete raw target-handler responses, not CLI/gateway envelopes or live authorization proof. Synthetic users/organizations exist only in isolated fixtures. Ordinary examples use simulated user identity while real authority, SQL and resolution are exercised. Discover actual intended targets, save only reviewed input as payload.json, validate and inspect the unchanged plan before an authorized call. --confirm assumes intended approval. Stored rows and computed modes do not prove dispatch, receipt, timers or application action execution.

User resolution has no event defaults, picks user policy and applies required-action in-app guard

Input · payload.json:

{
  "userId": "usr_self",
  "org_id": "org_example",
  "event_type": "campaigns.send_completed",
  "source_app_id": "app_topolo_campaigns"
}

CLI:

topolo actions validate app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json
topolo actions plan app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json
topolo actions call app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_notification_preferences.resolve",
    "input": {
      "userId": "usr_self",
      "org_id": "org_example",
      "event_type": "campaigns.send_completed",
      "source_app_id": "app_topolo_campaigns"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Notification preferences resolved",
  "data": {
    "user_id": "usr_self",
    "organization_id": "org_example",
    "event_type": "campaigns.send_completed",
    "channels": [],
    "addresses": {},
    "resolved_from": {
      "email": "event_default",
      "push": "event_default",
      "sms": "event_default",
      "in_app": "event_default",
      "whatsapp": "event_default"
    },
    "transactional": false,
    "timezone": "Europe/London",
    "policy_resolution": {
      "delivery_mode": "in_app_only",
      "required_action": true,
      "quiet_hours": {
        "start": "22:00",
        "end": "07:00",
        "timezone": "Europe/London"
      },
      "digest": null,
      "escalation": {
        "after_minutes": 30
      },
      "matched_rule": {
        "rule_id": "nap_P3Vnfea_aScP6RHa",
        "organization_id": "org_example",
        "user_id": "usr_self",
        "source_app_id": "*",
        "event_type": "*",
        "surface": "*",
        "category": "*",
        "priority": "*",
        "channel": "*",
        "delivery_mode": "muted",
        "required_action": true,
        "quiet_hours_json": "{\"start\":\"22:00\",\"end\":\"07:00\",\"timezone\":\"Europe/London\"}",
        "digest_json": null,
        "escalation_json": "{\"after_minutes\":30}",
        "quiet_hours": {
          "start": "22:00",
          "end": "07:00",
          "timezone": "Europe/London"
        },
        "digest": null,
        "escalation": {
          "after_minutes": 30
        },
        "enabled": true,
        "updated_at": 1790972360
      },
      "resolved_from": [
        "user_policy",
        "required_action_in_app_guard"
      ]
    }
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Enabled email without verified stored address is dropped, while in-app needs no address

Input · payload.json:

{
  "userId": "usr_self",
  "org_id": "org_example",
  "event_type": "campaigns.send_completed",
  "source_app_id": "app_topolo_campaigns"
}

CLI:

topolo actions validate app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json
topolo actions plan app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json
topolo actions call app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_notification_preferences.resolve",
    "input": {
      "userId": "usr_self",
      "org_id": "org_example",
      "event_type": "campaigns.send_completed",
      "source_app_id": "app_topolo_campaigns"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Notification preferences resolved",
  "data": {
    "user_id": "usr_self",
    "organization_id": "org_example",
    "event_type": "campaigns.send_completed",
    "channels": [
      "in_app"
    ],
    "addresses": {
      "email": null,
      "in_app": null
    },
    "resolved_from": {
      "email": "no_verified_address",
      "push": "event_default",
      "sms": "event_default",
      "in_app": "user_global_all_channel",
      "whatsapp": "event_default"
    },
    "transactional": false,
    "timezone": "Europe/London",
    "policy_resolution": {
      "delivery_mode": "in_app_only",
      "required_action": true,
      "quiet_hours": {
        "start": "22:00",
        "end": "07:00",
        "timezone": "Europe/London"
      },
      "digest": null,
      "escalation": {
        "after_minutes": 30
      },
      "matched_rule": {
        "rule_id": "nap_P3Vnfea_aScP6RHa",
        "organization_id": "org_example",
        "user_id": "usr_self",
        "source_app_id": "*",
        "event_type": "*",
        "surface": "*",
        "category": "*",
        "priority": "*",
        "channel": "*",
        "delivery_mode": "muted",
        "required_action": true,
        "quiet_hours_json": "{\"start\":\"22:00\",\"end\":\"07:00\",\"timezone\":\"Europe/London\"}",
        "digest_json": null,
        "escalation_json": "{\"after_minutes\":30}",
        "quiet_hours": {
          "start": "22:00",
          "end": "07:00",
          "timezone": "Europe/London"
        },
        "digest": null,
        "escalation": {
          "after_minutes": 30
        },
        "enabled": true,
        "updated_at": 1790972360
      },
      "resolved_from": [
        "user_policy",
        "required_action_in_app_guard"
      ]
    }
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Stored address flag makes email a computed candidate, not proof of ownership or delivery

Input · payload.json:

{
  "userId": "usr_self",
  "org_id": "org_example",
  "event_type": "campaigns.send_completed",
  "source_app_id": "app_topolo_campaigns"
}

CLI:

topolo actions validate app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json
topolo actions plan app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json
topolo actions call app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_notification_preferences.resolve",
    "input": {
      "userId": "usr_self",
      "org_id": "org_example",
      "event_type": "campaigns.send_completed",
      "source_app_id": "app_topolo_campaigns"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Notification preferences resolved",
  "data": {
    "user_id": "usr_self",
    "organization_id": "org_example",
    "event_type": "campaigns.send_completed",
    "channels": [
      "email",
      "in_app"
    ],
    "addresses": {
      "email": "synthetic-route@example.test",
      "in_app": null
    },
    "resolved_from": {
      "email": "user_global_all_channel",
      "push": "event_default",
      "sms": "event_default",
      "in_app": "user_global_all_channel",
      "whatsapp": "event_default"
    },
    "transactional": false,
    "timezone": "Europe/London",
    "policy_resolution": {
      "delivery_mode": "in_app_only",
      "required_action": true,
      "quiet_hours": {
        "start": "22:00",
        "end": "07:00",
        "timezone": "Europe/London"
      },
      "digest": null,
      "escalation": {
        "after_minutes": 30
      },
      "matched_rule": {
        "rule_id": "nap_P3Vnfea_aScP6RHa",
        "organization_id": "org_example",
        "user_id": "usr_self",
        "source_app_id": "*",
        "event_type": "*",
        "surface": "*",
        "category": "*",
        "priority": "*",
        "channel": "*",
        "delivery_mode": "muted",
        "required_action": true,
        "quiet_hours_json": "{\"start\":\"22:00\",\"end\":\"07:00\",\"timezone\":\"Europe/London\"}",
        "digest_json": null,
        "escalation_json": "{\"after_minutes\":30}",
        "quiet_hours": {
          "start": "22:00",
          "end": "07:00",
          "timezone": "Europe/London"
        },
        "digest": null,
        "escalation": {
          "after_minutes": 30
        },
        "enabled": true,
        "updated_at": 1790972360
      },
      "resolved_from": [
        "user_policy",
        "required_action_in_app_guard"
      ]
    }
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Organization forbids clamp nontransactional channels

Input · payload.json:

{
  "userId": "usr_self",
  "org_id": "org_example",
  "event_type": "campaigns.send_completed",
  "source_app_id": "app_topolo_campaigns"
}

CLI:

topolo actions validate app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json
topolo actions plan app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json
topolo actions call app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_notification_preferences.resolve",
    "input": {
      "userId": "usr_self",
      "org_id": "org_example",
      "event_type": "campaigns.send_completed",
      "source_app_id": "app_topolo_campaigns"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Notification preferences resolved",
  "data": {
    "user_id": "usr_self",
    "organization_id": "org_example",
    "event_type": "campaigns.send_completed",
    "channels": [
      "in_app"
    ],
    "addresses": {
      "in_app": null
    },
    "resolved_from": {
      "email": "org_policy_forbid",
      "push": "event_default",
      "sms": "event_default",
      "in_app": "user_global_all_channel",
      "whatsapp": "event_default"
    },
    "transactional": false,
    "timezone": "Europe/London",
    "policy_resolution": {
      "delivery_mode": "in_app_only",
      "required_action": true,
      "quiet_hours": {
        "start": "22:00",
        "end": "07:00",
        "timezone": "Europe/London"
      },
      "digest": null,
      "escalation": {
        "after_minutes": 30
      },
      "matched_rule": {
        "rule_id": "nap_P3Vnfea_aScP6RHa",
        "organization_id": "org_example",
        "user_id": "usr_self",
        "source_app_id": "*",
        "event_type": "*",
        "surface": "*",
        "category": "*",
        "priority": "*",
        "channel": "*",
        "delivery_mode": "muted",
        "required_action": true,
        "quiet_hours_json": "{\"start\":\"22:00\",\"end\":\"07:00\",\"timezone\":\"Europe/London\"}",
        "digest_json": null,
        "escalation_json": "{\"after_minutes\":30}",
        "quiet_hours": {
          "start": "22:00",
          "end": "07:00",
          "timezone": "Europe/London"
        },
        "digest": null,
        "escalation": {
          "after_minutes": 30
        },
        "enabled": true,
        "updated_at": 1790972360
      },
      "resolved_from": [
        "user_policy",
        "required_action_in_app_guard"
      ]
    }
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Without explicit user policy the resolver selects the matching organization policy

Input · payload.json:

{
  "userId": "usr_self",
  "org_id": "org_example",
  "event_type": "campaigns.send_completed",
  "source_app_id": "app_topolo_campaigns"
}

CLI:

topolo actions validate app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json
topolo actions plan app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json
topolo actions call app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_notification_preferences.resolve",
    "input": {
      "userId": "usr_self",
      "org_id": "org_example",
      "event_type": "campaigns.send_completed",
      "source_app_id": "app_topolo_campaigns"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Notification preferences resolved",
  "data": {
    "user_id": "usr_self",
    "organization_id": "org_example",
    "event_type": "campaigns.send_completed",
    "channels": [
      "in_app"
    ],
    "addresses": {
      "in_app": null
    },
    "resolved_from": {
      "email": "org_policy_forbid",
      "push": "event_default",
      "sms": "event_default",
      "in_app": "user_global_all_channel",
      "whatsapp": "event_default"
    },
    "transactional": false,
    "timezone": "Europe/London",
    "policy_resolution": {
      "delivery_mode": "digest",
      "required_action": false,
      "quiet_hours": null,
      "digest": null,
      "escalation": null,
      "matched_rule": {
        "rule_id": "nap_IExVJt9-5uAJux-v",
        "organization_id": "org_example",
        "user_id": null,
        "source_app_id": "app_topolo_campaigns",
        "event_type": "campaigns.send_completed",
        "surface": "*",
        "category": "*",
        "priority": "*",
        "channel": "*",
        "delivery_mode": "digest",
        "required_action": false,
        "quiet_hours_json": null,
        "digest_json": null,
        "escalation_json": null,
        "quiet_hours": null,
        "digest": null,
        "escalation": null,
        "enabled": true,
        "updated_at": 1790972360
      },
      "resolved_from": [
        "org_policy",
        "matched_rule"
      ]
    }
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

No matching action-policy row returns default immediate with matched_rule null

Input · payload.json:

{
  "userId": "usr_self",
  "org_id": "org_example",
  "event_type": "campaigns.send_completed",
  "source_app_id": "app_topolo_campaigns"
}

CLI:

topolo actions validate app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json
topolo actions plan app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json
topolo actions call app_topolo_auth.user_notification_preferences.resolve --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_notification_preferences.resolve",
    "input": {
      "userId": "usr_self",
      "org_id": "org_example",
      "event_type": "campaigns.send_completed",
      "source_app_id": "app_topolo_campaigns"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Notification preferences resolved",
  "data": {
    "user_id": "usr_self",
    "organization_id": "org_example",
    "event_type": "campaigns.send_completed",
    "channels": [
      "in_app"
    ],
    "addresses": {
      "in_app": null
    },
    "resolved_from": {
      "email": "org_policy_forbid",
      "push": "event_default",
      "sms": "event_default",
      "in_app": "user_global_all_channel",
      "whatsapp": "event_default"
    },
    "transactional": false,
    "timezone": "Europe/London",
    "policy_resolution": {
      "delivery_mode": "immediate",
      "required_action": false,
      "quiet_hours": null,
      "digest": null,
      "escalation": null,
      "matched_rule": null,
      "resolved_from": [
        "default"
      ]
    }
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Trusted Notify context captures

These inputs require the owning trusted TopoloNotify service identity. Ephemeral local RS256/JWKS verification proves that handler boundary without using a live credential. No public CLI/MCP gateway transport or live deployment is proved; ordinary OAuth must not run these service-only inputs. No message was sent.

Trusted Notify service uses transactional defaults rather than preference/organization clamps

{
  "credentialPrerequisite": "ephemeral-local-trusted-notify-service",
  "input": {
    "userId": "usr_self",
    "org_id": "org_example",
    "event_type": "campaigns.send_completed",
    "source_app_id": "app_topolo_campaigns",
    "default_channel": [
      "email"
    ],
    "transactional": "true"
  },
  "response": {
    "success": true,
    "message": "Notification preferences resolved",
    "data": {
      "user_id": "usr_self",
      "organization_id": "org_example",
      "event_type": "campaigns.send_completed",
      "channels": [
        "email"
      ],
      "addresses": {
        "email": "synthetic-route@example.test"
      },
      "resolved_from": {
        "email": "transactional_default",
        "push": "transactional_default",
        "sms": "transactional_default",
        "in_app": "transactional_default",
        "whatsapp": "transactional_default"
      },
      "transactional": true,
      "timezone": "Europe/London",
      "policy_resolution": {
        "delivery_mode": "in_app_only",
        "required_action": true,
        "quiet_hours": {
          "start": "22:00",
          "end": "07:00",
          "timezone": "Europe/London"
        },
        "digest": null,
        "escalation": {
          "after_minutes": 30
        },
        "matched_rule": {
          "rule_id": "nap_P3Vnfea_aScP6RHa",
          "organization_id": "org_example",
          "user_id": "usr_self",
          "source_app_id": "*",
          "event_type": "*",
          "surface": "*",
          "category": "*",
          "priority": "*",
          "channel": "*",
          "delivery_mode": "muted",
          "required_action": true,
          "quiet_hours_json": "{\"start\":\"22:00\",\"end\":\"07:00\",\"timezone\":\"Europe/London\"}",
          "digest_json": null,
          "escalation_json": "{\"after_minutes\":30}",
          "quiet_hours": {
            "start": "22:00",
            "end": "07:00",
            "timezone": "Europe/London"
          },
          "digest": null,
          "escalation": {
            "after_minutes": 30
          },
          "enabled": true,
          "updated_at": 1790972360
        },
        "resolved_from": [
          "user_policy",
          "required_action_in_app_guard"
        ]
      }
    },
    "timestamp": "2026-10-02T00:00:00.000Z"
  },
  "status": 200,
  "proof": "local-handler-real-policy-sql-and-service-signature-fixture"
}

Trusted Notify nontransactional defaults remain clamped by organization rules

{
  "credentialPrerequisite": "ephemeral-local-trusted-notify-service",
  "input": {
    "userId": "usr_self",
    "org_id": "org_example",
    "event_type": "campaigns.send_completed",
    "source_app_id": "app_topolo_campaigns",
    "default_channel": [
      "email",
      "in_app"
    ],
    "transactional": "false"
  },
  "response": {
    "success": true,
    "message": "Notification preferences resolved",
    "data": {
      "user_id": "usr_self",
      "organization_id": "org_example",
      "event_type": "campaigns.send_completed",
      "channels": [
        "in_app"
      ],
      "addresses": {
        "in_app": null
      },
      "resolved_from": {
        "email": "org_policy_forbid",
        "push": "event_default",
        "sms": "event_default",
        "in_app": "user_global_all_channel",
        "whatsapp": "event_default"
      },
      "transactional": false,
      "timezone": "Europe/London",
      "policy_resolution": {
        "delivery_mode": "in_app_only",
        "required_action": true,
        "quiet_hours": {
          "start": "22:00",
          "end": "07:00",
          "timezone": "Europe/London"
        },
        "digest": null,
        "escalation": {
          "after_minutes": 30
        },
        "matched_rule": {
          "rule_id": "nap_P3Vnfea_aScP6RHa",
          "organization_id": "org_example",
          "user_id": "usr_self",
          "source_app_id": "*",
          "event_type": "*",
          "surface": "*",
          "category": "*",
          "priority": "*",
          "channel": "*",
          "delivery_mode": "muted",
          "required_action": true,
          "quiet_hours_json": "{\"start\":\"22:00\",\"end\":\"07:00\",\"timezone\":\"Europe/London\"}",
          "digest_json": null,
          "escalation_json": "{\"after_minutes\":30}",
          "quiet_hours": {
            "start": "22:00",
            "end": "07:00",
            "timezone": "Europe/London"
          },
          "digest": null,
          "escalation": {
            "after_minutes": 30
          },
          "enabled": true,
          "updated_at": 1790972360
        },
        "resolved_from": [
          "user_policy",
          "required_action_in_app_guard"
        ]
      }
    },
    "timestamp": "2026-10-02T00:00:00.000Z"
  },
  "status": 200,
  "proof": "local-handler-real-policy-sql-and-service-signature-fixture"
}

Verify the result

Require user_id/organization_id/event_type to equal the intended context. Inspect both per-channel resolved_from and policy_resolution resolved_from/matched_rule; candidate channels are not final dispatch targets.
Read relevant global/org preference scopes, verified address rows and org/user action policies if the result is unexpected. Use Notify dispatch/receipt and actual timer/action reads for runtime outcomes; local service-token proof does not prove a live gateway accepts that credential.

Errors and recovery

User OAuth cannot supply Notify-owned event contract defaults

Captured local refusal · HTTP 400:

{
  "credentialPrerequisite": "simulated-user-token",
  "input": {
    "userId": "usr_self",
    "org_id": "org_example",
    "event_type": "campaigns.send_completed",
    "source_app_id": "app_topolo_campaigns",
    "default_channel": [
      "email",
      "in_app"
    ],
    "transactional": "false"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Invalid policy query parameters",
      "code": "VALIDATION_ERROR",
      "details": [
        "contract policy is restricted to TopoloNotify"
      ],
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Trusted Notify must provide explicit transactional true or false

Captured local refusal · HTTP 400:

{
  "credentialPrerequisite": "ephemeral-local-trusted-notify-service",
  "input": {
    "userId": "usr_self",
    "org_id": "org_example",
    "event_type": "campaigns.send_completed",
    "source_app_id": "app_topolo_campaigns"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Invalid policy query parameters",
      "code": "VALIDATION_ERROR",
      "details": [
        "transactional must be true or false"
      ],
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Trusted Notify duplicate default channels are refused

Captured local refusal · HTTP 400:

{
  "credentialPrerequisite": "ephemeral-local-trusted-notify-service",
  "input": {
    "userId": "usr_self",
    "org_id": "org_example",
    "event_type": "campaigns.send_completed",
    "source_app_id": "app_topolo_campaigns",
    "default_channel": [
      "email",
      "email"
    ],
    "transactional": "false"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Invalid policy query parameters",
      "code": "VALIDATION_ERROR",
      "details": [
        "default_channel must be unique"
      ],
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Another correctly signed local service is not trusted Notify

Captured local refusal · HTTP 401:

{
  "credentialPrerequisite": "ephemeral-local-other-service",
  "input": {
    "userId": "usr_self",
    "org_id": "org_example",
    "event_type": "campaigns.send_completed",
    "source_app_id": "app_topolo_campaigns"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Invalid access token",
      "code": "AUTH_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Ordinary user cannot resolve another user notification policy

Captured local refusal · HTTP 401:

{
  "credentialPrerequisite": "simulated-user-token",
  "input": {
    "userId": "usr_other",
    "org_id": "org_example",
    "event_type": "campaigns.send_completed",
    "source_app_id": "app_topolo_campaigns"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Access denied",
      "code": "AUTH_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Anonymous resolver is refused

Captured local refusal · HTTP 401:

{
  "credentialPrerequisite": "simulated-user-token",
  "input": {
    "userId": "usr_self",
    "org_id": "org_example",
    "event_type": "campaigns.send_completed",
    "source_app_id": "app_topolo_campaigns"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Access token required",
      "code": "AUTH_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Published recovery guidance

AUTH_ERROR (HTTP 401): Verify pinned identity and respect the exact user/organization boundary. A valid other-service signature is not Notify trust; do not switch credentials or infer OAuth expiry from an authenticated target denial.
VALIDATION_ERROR (HTTP 400): Correct reported fields and unique complete dimension keys. Ordinary user resolution must omit defaults/transactional; only an owning trusted Notify invocation may supply them and must provide explicit transactional true/false. Revalidate and review any replacement.
SERVER_ERROR (HTTP 500): Preserve request/result and read the exact stored scope. A replacement may have removed prior rows and inserted only part of the intended set; separately review finishing or restoring complete captured semantic settings. Do not rely on old rule ids.

Recovery boundaries

Read-only stored or computed policy. Refresh relevant exact scopes after approved changes; no dispatch, delivery, timer or application action is executed here.

Discovery and evidence

This record belongs to app_topolo_auth. Fixtures prove actual authority, action-policy validation, canonical notification/core SQL, scoring/required-action guard, address/timezone resolution and partial replacement behavior. User tokens/targets/unused addresses are simulated. Trusted Notify captures use real ephemeral local RSA generation, Auth minting and local JWKS verification; no live credential/key is read or serialized. Current Notify source informs optional metadata field meanings, while its scheduling/dispatch is not exercised. No live storage, ownership, gateway credential parity, notification, timer, deployment or production publication is proved.