Decision context
- Authenticated user and active session.
- Organization membership and policy.
- Application identity and assigned access.
- Requested Lyra scope and resource.
- High-risk scope step-up state.
A denial is a valid result, not a transport failure. Record the decision ID and audit context without persisting prompt content, tokens, or unrelated personal data.