R3.3: Gateway ID discrimination

Short answer: Validate customer/subscription/checkout prefix before API call. The wrong kind of id sent to the gateway fails late, or charges the wrong object.

Group: Billing and money. Status: stable. Generated from the rule definitions; do not edit by hand.

Playground: https://brevio.pro/tools/agent-guard-playground?rule=R3.3

What it catches

Gateway ID discrimination: validate customer/subscription/checkout prefix before API call.

Why

The wrong kind of id sent to the gateway fails late, or charges the wrong object.

A bad example

await gateway.cancel(id);

A good example

if (!id.startsWith('sub_')) throw new Error('not a subscription');
await gateway.cancel(id);

How it is checked

A one-line card in the prompt of a slice that touches matching files (dev_rules.slice_micro_rules).

How to silence it

A person can silence one finding with brevio-core: ignore R3.3 -- reason on the line or the line above. Without the reason it does not count. An agent cannot silence it: the agent hook and the MCP tools never honour the comment, and a pull request that adds one is reported until a reviewer allows it. Fixing the code is still the better answer.

To change what the rule flags, edit its definition in dev_rules.py or code_rules/__init__.py. That is a code change and is reviewed like one.

R3.4 Pre-execution quota enforcement
R3.5 Transactional outbox
R3.1 Idempotent webhook processing
R3.2 Monetary integer representation
Every rule