+Use this pattern to separate access policy evaluation from the `seal_approve` step. Instead of checking the full policy inside `seal_approve`, your contract performs whatever authorization logic it needs (payment, role check, rate limit, etc.) and issues a `KeyRequest` object. The `seal_approve` function then only verifies that the `KeyRequest` is valid and unexpired, keeping policy evaluation outside of the Seal dry-run path. This is useful when your access policy is complex, when you need to guarantee safety during dry-run evaluation, or when you want to charge per key request. The pattern uses a witness type to bind each `KeyRequest` to the issuing package, preventing cross-contract forgery.
0 commit comments