Guard Clauses Belong at Workflow Entry, Not Buried in Steps

Validating preconditions at workflow entry fails cheap and early, while the same check buried in step seven fails after six steps of side effects.

Every precondition discovered at step seven was checkable at step zero. The difference is six steps of effects that now need unwinding.

Entry guard checklist

• Permissions for all risky steps verified before the first step runs.
• Required inputs validated for shape and freshness at the door.
• Capacity and dependency health checked before admission, not during.

Use the architecture guide, examples, and AuthGuardian to reject ineligible work before it spends anything.