Architecture
Authority model
Authority is declared before admission, in writing, with explicit denials. A run cannot negotiate for more once it is underway, because there is no runtime path that grants it.
- Declare
- Admit
- Execute
- Expire
Envelope
Scope, denial, budget, expiry.
An authority envelope states four things before any work starts: what the run may touch, what it explicitly may not touch, how much work it may consume, and when the grant stops being valid.
Explicit denials matter more than they look. A scope list describes intent; a denial list describes the blast radius you have decided to rule out. Deployment, database writes, secret reads and service restarts are denied by default because their consequences are not reversible by retrying.
Expiry is tied to the lease rather than to a wall-clock afterthought. There is no implicit renewal, so an abandoned run loses authority rather than retaining it indefinitely.
Granted
- repo:write (branch: feature/*)
- ci:read
- artifact:read
Denied
- deploy:*
- db:write
- secrets:read
- service:restart
Budget 40 tool calls / 15 min wall clock
Expiry Envelope expires with the lease. No implicit renewal.
Separation of duties
Five roles, held apart on purpose
Collapsing any two of these roles produces a system that can approve its own consequences.
- Proposer
- Prepares an action and the exact state it applies to. Cannot grant itself authority.
- Authority
- Issues a scoped, expiring envelope bound to that prepared state. Performs no work.
- Executor
- Applies the action exactly once under the envelope. Cannot widen its own scope.
- Signer
- Signs a receipt over action, prepared state and authority reference.
- Verifier
- Judges the result from outside the execution path, holding no write authority.
Give agents authority. Keep the proof.
Narrow authority is what makes broad autonomy survivable.