# NATS — verae-access-leaf

| Direction | Address | Kind |
|-----------|---------|------|
| IN | `verae.access.leaf.in` | queue `access-leaf` `{ token, target, payload, principal }` |
| OUT | `verae.access.authz.check` | request-reply |
| OUT | allowed `target` only | pub after allow |

Do not export `verae.billing.*` to the leaf account.