Module runtime 

Process-wide authz hook installed at server startup.

Both the gateway /v1/messages middleware and the MCP RBAC middleware consult global_hook to retrieve the active hook. After install_from_governance_config runs the slot is always populated with one of DenyAllHook, AllowAllHook, or WebhookHook — there is no “uninstalled” path that callers can fall through.

install_from_governance_config is the single source of truth for both the API server runtime and standalone MCP server binaries:

• mode: webhook with a non-empty url → WebhookHook (fail-closed).
• mode: disabled, or governance/authz absent → DenyAllHook.
• mode: unrestricted → AllowAllHook, but ONLY when acknowledgement exactly equals UNRESTRICTED_ACKNOWLEDGEMENT. Otherwise bootstrap fails.

Bootstrap ordering: this is called from AppContextBuilder::build after the database pool is created so the audit sink can write to governance_decisions.

Functions

clear_global_hook

global_hook

install_from_governance_config

install_global_hook