Authenticated Message Delivery With Controlled Routing Gateway

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause a system to perform operations comprising:

• maintaining a verified sender record generated from cryptographic signature validation and a blockchain ownership or control lookup;
• maintaining, in a binding-record data store, a subscription binding record keyed by at least a verified sender identifier and a recipient identifier;
• receiving, at a routing gateway service, a proposed outbound communication associated with the verified sender record and the recipient identifier;
• determining a current authorization decision for the recipient identifier from at least the verified sender record, the subscription binding record, an opt-in state, a channel type, and a policy version;
• only when the current authorization decision is an allow decision, generating an authorization artifact comprising either a signed authorization token or a gateway-generated authorization decision identifier that uniquely identifies an authorization decision record stored by the routing gateway service, the authorization artifact being bound to at least
• a communication identifier,
• the recipient identifier,
• the channel type,
• the verified sender identifier,
• a binding identifier,
• the policy version,
• an issued-at time,
• an expiration time,
• and a nonce;
• causing a delivery adapter process to validate the authorization artifact before the delivery adapter process
• retrieves a transport credential,
• uses a cached transport credential,
• creates a channel payload,
• writes an outbound queue entry,
• calls a provider API,
• writes to an inbox store,
• signs a webhook request,
• resolves a push token,
• or opens an outbound network connection;
• preventing the delivery adapter process from
• retrieving the transport credential,
• using the cached transport credential,
• creating the channel payload,
• writing the outbound queue entry,
• calling the provider API,
• writing to the inbox store,
• signing the webhook request,
• resolving the push token,
• or opening the outbound network connection when the current authorization decision is not the allow decision or when the authorization artifact fails validation;
• and
• enforcing a non-bypass control that prevents a non-gateway service identity from retrieving or using the transport credential and from reaching an endpoint of the delivery adapter process.

A computer-implemented method for controlling replay of a failed outbound communication, the method comprising:

• after a first delivery attempt for a communication identifier and a recipient identifier has failed or has not completed, storing, by one or more processors, a queue item in a retry queue or a dead-letter queue, the queue item being associated with the communication identifier, the recipient identifier, and an initial authorization artifact used for the first delivery attempt, the initial authorization artifact comprising an initial authorization token or an initial gateway-generated authorization decision identifier;
• receiving, at a routing gateway service, a replay request or redrive request for the queue item;
• in response to the replay request or redrive request, generating, after the failed or incomplete first delivery attempt, a new authorization decision for the recipient identifier by rechecking current verified-sender state, current binding-record state, current opt-in state, current endpoint state, and current channel policy;
• only when the new authorization decision is an allow decision, generating a fresh authorization artifact comprising a fresh authorization token or a fresh gateway-generated authorization decision identifier, the fresh authorization artifact being distinct from the initial authorization artifact;
• marking the initial authorization artifact as replay-ineligible for the replay request or redrive request after the failed or incomplete first delivery attempt;
• rejecting reuse of the initial authorization artifact for the replay request or redrive request;
• requiring a delivery adapter process, before
• retrieving a transport credential,
• using a cached transport credential,
• creating a channel payload,
• writing an outbound queue entry,
• calling a provider API,
• writing to an inbox store,
• signing a webhook request,
• resolving a push token,
• or opening an outbound network connection for the replay request or redrive request,
• to validate the fresh authorization artifact;
• and refraining from
• retrieving the transport credential,
• using the cached transport credential,
• creating the channel payload,
• writing the outbound queue entry,
• calling the provider API,
• writing to the inbox store,
• signing the webhook request,
• resolving the push token,
• or opening the outbound network connection for the replay request or redrive request unless the fresh authorization artifact validates and the new authorization decision is the allow decision.