The one destructive workspace operation's body.
The consequence is presented by the caller and accepted before this is sent (rev 4 §4.2 step 2, S13). What crosses is the acceptance: the token the gateway issued alongside the consequence it computed, round-tripped unchanged - see [WorkspaceConfirmation].
It is still not a credential: the scope is what authorizes the operation. What the token adds is that the acceptance is about something. A token the gateway does not recognise, one issued for another workspace or another action, one already spent, or one that has expired is refused before anything is closed.
