A session is context. A request needs proof.

The proposed design verifies cryptographic proof of possession on every protected request. Freshness and single-use handling are additional requirements: a signature alone cannot prevent resubmission.

Dual-signed describes a signature profile, not two human approvers. Mandatory both-signature enforcement and compatibility behaviour must be established in the selected CISP profile.

A compromised endpoint or signing context remains a separate risk. Application permission checks are required even for a valid request.