Off-Host, Identity-Bound Authorization

aiAuthZ (Kodathala): an authorization gateway in a separate trust domain that HMAC-authenticates each human message and enforces role + argument-level policy the agent can neither read nor modify — a call's authority derives from the last verified human message, not model text; 0% residual attack success across 15 models; the off-host counterpart to ScopeGate.