Author grants and actions

Guide / auths-author

auths-author provides pure, keyless authoring:

• plan_child_grant and PlanBuilder compare proposed child authority with its parent and report over-granting;
• prepare_grant creates a signing request for an exact grant statement;
• prepare_action creates a signing request for an exact action;
• status authoring functions prepare principal and grant status statements; and
• ExternalSigningRequest<T> carries the exact domain-separated preimage and signing-object identity.

Custody stays outside

The authoring crate has no private keys and performs no provider I/O. The downstream custody layer can send the exact signing intent to WebAuthn, KMS, HSM, workload, or PKCS#11 providers and must reject a response that does not bind to the intended preimage.

Caution

Planning protects against accidental over-granting. A successfully constructed signing request is not itself a signed grant and does not prove authority.