When an external system needs to trigger an action inside a protocol, how does the request get in, and how is it authorized?

External systems reach in through REST calls carrying a short-lived JWT (JSON Web Token) whose claims identify the party and the rights relevant to that action.

Reacting to external events works like this: an integration service detects something happening outside, then sends a REST request to the Runtime to trigger the corresponding action. That request must include a valid JWT — a JSON Web Token, a compact signed token that carries "claims" (assertions about the caller). The JWT is short-lived (to limit the damage if it leaks) and its claims describe the party involved, so the Runtime knows which protocol party is acting and whether they are permitted to. REST here is often preferable to fully decoupled messaging precisely because the Runtime guarantees no blocking I/O happens during transactional processing, so the synchronous call stays fast and safe.

Go deeper:

• JSON Web Token (Wikipedia) — the signed, claims-carrying compact token format; why short expiry limits the blast radius of a leaked token.