Rights are drawn through one database function

Context

Consumers need benefit use to succeed or fail with their own records.

Decision

Give consumers a constrained execution role for the consumption function, keeping allowance and validity checks inside one database boundary.

Alternatives Considered

An HTTP draw would commit independently of the consuming record. Direct use-table writes would duplicate allowance and replay rules in every consumer.

Consequences

Consumers depend on a coordinated database signature. Revocation affects active-rights reads as soon as its transaction commits.