work around response format ambiguity
move decision points into security context
sealed security context