Human authority
Where a person must decide, and how that is enforced
Autonomy is not all-or-nothing. The policy decides which band an action falls into, and the band decides who is allowed to release it.
The authority bands
| Band | Verdict | What happens |
|---|---|---|
| Routine | Automatic | Inside the configured limit and a permitted destination. Executes without a human, and still produces signed evidence. |
| Sensitive | Hold | No effect until a separately authenticated person with the required role approves that exact request. The approval is single-use. |
| Prohibited | Deny | No effect, and no approval can release it. The refusal is recorded as signed evidence in its own right. |
| Emergency | Revoke | Authority withdrawn. The agent's next request cannot execute, and work already approved but not yet dispatched cannot execute either. |
What makes an approval meaningful
Bound to the payload
The approval covers that exact request. Altering any governed field after approval invalidates it — the approval cannot be carried onto a different action.
Single-use
An approval is consumed by the dispatch it authorizes. Replaying it produces no second effect.
Separately authenticated
The approver authenticates independently of the requesting agent and must hold the role the policy requires. An agent cannot approve its own request.
Re-decided at dispatch
Between approval and execution the policy may have changed or authority may have been revoked. The decision is taken again at the moment of dispatch.
Verdicts
Human approval, bound and single-use
ProvenAn action held for approval produces no effect until a separately authenticated human with the required role approves that exact request. The approval is bound to the payload and the envelope, is consumed once, and cannot release a different action or the same action twice.
Revocation of agent authority
ProvenAn authorized operator can revoke an agent. Its next request cannot execute, and an action it had already had approved but not yet dispatched cannot execute either — revocation reaches work already in flight, not only new requests.
Unknown outcomes stay unknown
ProvenWhen a request was transmitted but the answer never arrived, the system records the outcome as unresolved and retains the budget. It does not retry blindly and it does not convert an unknown into a failure to make the state tidy. Reconciliation then determines what actually happened.