Abort kickoff at EXECUTION_START when userinfo rejects the bearer. HookAborted is the refusal. A missing token takes the same path.
Getting started, including the planned sample, is CrewAI.
What fails closed
Kickoff with no token raises HookAborted. No tool result contains a subject.
Kickoff with a bearer userinfo accepts stores that subject and continues. whoami returns it.
A resolved subject is not authorization. Scopes and allowed tools are a later check. The trust-store sample is that later check for MCP. This page stops at admission.
Related
| Read | To learn how to |
|---|---|
| CrewAI | See the hook |
| API keys and M2M for CrewAI | Where the secret is allowed to live |
| Authorizing tool calls for CrewAI | What happens after the subject is known |