# NATS — verae-access-authz

| Direction | Address | Kind |
|-----------|---------|------|
| IN | `verae.access.authz.check` | request-reply, queue `access-authz` |
| OUT | `verae.access.authz.deny` | pub on deny (audit) |

Body in: `{ plane, subject, principal, kind, payload }`.  
Body out: `{ allow, plane, subject, reason }`.

Fail closed: if this process is down, access gateways must not forward.