Audit, outbox, flags, and entitlements are server-gated.

Planned StudentRecordViewed for student; secret-shaped metadata is redacted before storage.

StudentEnrolled is pending with idempotency key StudentEnrolled:student:student-proof. Dispatch is intentionally later.

Unknown flags fail closed unless a server-side definition or override enables them.

The Advisor flag is enabled for one tenant by a reasoned override: local proof override.

A feature can be enabled but still denied when its required entitlement is missing.

Feature access is allowed when the server-side flag and entitlement both pass.