The zPo authorization contract: the principal a gateway establishes, the role vocabulary and its capabilities, tenant selection and the ownership rule. Transport-neutral, so a gateway speaking any protocol enforces the same policy.