Client OAuth
idleClaude → gateway · token chain A → B0 → Task Envelope → B
Authentication pipeline
Three identities · one gateway
Upstream OAuth
idlegateway → ERP MCP · client-credentials mint / call
Legacy SAP
idlegateway → SAP · basic auth / CSRF / write / retry
Ledger state
idleHuman approval required
Approval ceremony
No write reaches SAP until a person signs the exact values below with a passkey (Touch ID). The signature covers the write-effective fields verbatim.
- No pending proposals. Call
sap_create_orderfrom the MCP client to start one.