Source: MIZOKI audit 2026-09-06 (pinned fc8b03f9) → work-order backlog 2026-09-08 (docs/audits/AUDIT_WORK_ORDERS_2026-09-08.md). Findings are hypotheses until reproduced on current main (WO-00).

Finding: Approval service compares a request-body actor string with the requesting service; the same service passes by inventing a human name [R5]. Files: services/service-approval-routing/main.py; principal auth module. Fix: approver identity and role come only from the verified principal; body-supplied actor fields are ignored or must match the principal. Service allowlisting ≠ human approval. Acceptance: HTTP test with a service principal and a body actor of a different human → 403. Test with a verified human principal lacking the role → 403. Depends on: WO-00.