Authority, Leases & Permits
Delegate bounded authority that cannot silently exceed its parent.
A parent can delegate work through a scoped, chained permit. Leases make authority time-bounded; boot receipts prove the worker loaded required context; revocation can fence a subtree.
Instead of giving every worker a master key, you give them a temporary key that opens only the doors needed for one job. A child cannot make a stronger key than the one its parent had.
Primitive separates identity, work allocation and authority. A task can be assigned without automatically granting every consequential action. Permit chains create an inspectable delegation path, while gateways enforce the permission at the point where real effects occur.
Where this concept shows up
Permit scope
The Control programme specifies scope such as repositories, branches, paths, budget, expiry and child cap. A child permit is bounded by its parent's permit.
Boot receipt
A worker starts locked and returns hashes of its context manifest, loaded tools and authority acknowledgement before write access can unlock.
Lease and heartbeat
Leases and heartbeat/deadline mechanisms make stale or blocked authority observable rather than indefinite.
Revocation
Revoking a parent can fence its subtree, providing a recursive stop mechanism.
Source lineage
Concept pages preserve whether an idea is canonical, proposed or working theory. That label is independent from whether a related product feature is implemented.