Architecture · 13 of 19 · Authority

Effective authority is the minimum of five inputs, and runtime can only lower it

Any of the five can say no; none can say yes on behalf of another. The claim and the parent can only narrow what the definition grants, and the breaker can only take authority away, so a compromised run cannot widen its own reach.

Effective authority is the minimum of five inputs, and runtime can only lower it Architecture showing five inputs, the git-managed agent definition, the human's delegated permissions, the narrow-only run claim, the parent run's remaining budget, and a reduce-only runtime breaker, feeding one CEL policy decision that yields allow with an audit row, deny with a rule id, or propose only for a pull request that a human merges. TIER CEILINGUSER RIGHTSNARROWED TOPARENT LEFTTRIPPED?T0 · T1RULE IDT2AgentDefinitionin git · reviewedHuman delegationTower permission policyRun claimnarrow-only, per runParent runwhat the parent has leftRuntime breakerreduce-only statePolicy decisionCEL over all five inputsAllowaudit row writtenDenyrule id back to the agentPropose onlyPR opened, human mergesRaising authority is a reviewed commit. Lowering it is immediate and needs no review.LEGENDDecisionReduce-onlyInputOutcome: propose

Principle honored

Least privilege, fail toward less. Runtime state may only reduce authority; raising it is a git commit, like every other durable change.

What changes

  • Definitions live in gitops-infra-clearance/agents/*.yaml, schema-validated like cicd.yaml is.
  • The breaker is state inside Clearance only; a tripped run is also frozen by setting one field on its AgentRun.
  • Sessions live in memory on one replica for now. A restart ends them, which is the safe direction.

Proved in code

Fifteen CEL rules, each with an id and a hint, are tested one at a time: each input alone must force a deny, and the whole policy must fail closed if evaluation errors. That table is in the repository.

Hangar · Autopilot