Report-only: GatewayDispatch::invoke hardwires ownership: None, so External namespace-ACL ops through the HTTP gateway fall back to the static Identity.resources model — token-carried claims admit without consulting revocable grant tables (POC-L tests/gateway_gap.rs). Three resolution shapes recorded; disposition is session-owned.