Grants and delegation

Concept / attenuation

01 / Trust

Trusted root

Authority starts from a verifier-configured anchor.

narrows

02 / Delegate

Bounded grant

Capability, resource, audience, and time become tighter.

binds

03 / Execute

Exact action

The verified bytes become the only executable command.

A grant delegates a subset of authority from one principal to another. The kernel compares every child grant with its effective parent authority.

Attenuated dimensions

• accepted principal methods and profiles;
• permission capability and resource;
• resource namespaces;
• audience set;
• validity window;
• stateful budget ceiling;
• remaining delegation depth;
• assurance policy; and
• status policy.

If a child expands authority in any protected dimension, verification returns a stable denial such as delegation-expanded.

Plans

Authorization plans compose proof leaves through proof, all-of, any-of, and K-of-N operators. Composition selects which valid branches satisfy an action; it cannot grant authority absent from those branches.