Answer card
A term-sheet approval URL is the human sign-off screen for an agent's request to touch real money or a real broker. Before signing, read four things: scope (what it may do), worst-case-in-dollars (the most it can lose), expiry (when it dies on its own), and revocation (how to kill it now). If any slider on the page can loosen those limits instead of only tightening them, the term sheet is malformed; don't sign it.
Why this screen exists
On kestrel.markets, the brains stay outside: the external-agent invariant. An agent authors a strategy, validates it in simulation, and produces a shareable proof, but its wallet can only sign commerce-only scopes: data, sim, grade, paper. The moment a request crosses into legal, broker, or LIVE territory, a human must sign. That is the two-signer rule, and the term-sheet approval URL is where the human does the signing.
The screen exists because "click yes to authorize the agent" is not consent; it is a blank check. The approval URL replaces the blank check with a contract short enough to actually read.
The one primitive being approved: the Envelope
Everything on the page describes a single authorization primitive: the Envelope. An Envelope is exactly five fields:
{ scope, budget, ceiling, expiry, revocation }That is the whole grammar of trading authority on the platform. There is no sixth field, no hidden clause, no "and other reasonable actions." If a capability is not named in the scope, the agent does not have it. Read the Envelope and you have read the entire deal.
Rendered for a human, an illustrative term sheet reads like this (generic instrument, illustrative only):
Envelope (illustrative)
scope: buy bracketed SPY 0dte options in Book intraday-reversion
budget: 2R
ceiling: worst-case-in-dollars $1,200
expiry: 2026-07-12 16:00 ET (this session, then dead)
revocation: one-tap · holder: you (sole)Field by field
1. Scope: what it may do
Scope is the enumerated list of actions this Envelope permits, and nothing else. Read it as a closed list, not a theme. "Place bracketed options orders in Book intraday-reversion" is a scope. "Trade options" is not; it is too wide, and a well-formed term sheet will not offer it.
Two properties make scope trustworthy:
- Authority only narrows downward. The recursive POD tree allocates risk from a parent pod to child books and traders; a child can never hold authority its parent lacks. The Envelope being signed cannot grant more than the pod it lives in already has.
- Risk (L0) can clamp or veto anyone, including the agent, and may never OPEN risk. The safety layer can only tighten. There is no path, on this page or anywhere behind it, for a signature to widen exposure beyond what is approved here.
2. Worst-case-in-dollars: the number that matters
This is the field the whole screen is built around. budget and ceiling live in the Envelope's own units (risk units, position caps), but the term-sheet approval URL renders them as worst-case-in-dollars: the largest amount that can be lost if every position moves against the book to its bracketed invalidation, simultaneously.
It is not an estimate of likely loss. It is the floor of the account after the worst in-bracket outcome of everything this Envelope can do. The Envelope's job is to guarantee that this number is the most that can happen, so read it as if it will.
A note on honesty: bracketed worst-case assumes fills at the invalidation prices. Real markets gap. The support flag refuses to bank extrapolated fills when grading, and a serious term sheet says plainly that gap risk can exceed the stated worst case in a fast, illiquid market. A backtest is never flattering here, and neither is a term sheet.
3. Expiry: when it dies on its own
Expiry is mandatory. There is no such thing as a standing, never-ending Envelope. Every authorization carries a wall-clock death: an hour, a session, a day. When the clock runs out, the authority evaporates whether or not anyone touched it: no renewal, no rollover.
This is the difference between "an agent was authorized last March" and a live liability someone forgot about. On this platform, the March authorization is already dead. Expiry should match the horizon of the actual intent, not longer.
4. Revocation: how to kill it now
Expiry is the automatic off-switch; revocation is the manual one. The term sheet shows a one-tap revocation path: a single action that voids the Envelope immediately, cancels its standing programs, and returns authority to the signer. No support ticket, no unwind negotiation.
Revocation and the live singleton work together: LIVE is a platform-enforced singleton per pod lineage, so there is exactly one live authority to revoke, never a tangle of forgotten sessions. Before signing, the kill switch should be visible and solely the signer's to press.
The rule that makes the sliders safe
The term-sheet approval URL is interactive. The budget can be dragged down, the expiry shortened, the scope narrowed. One rule governs every control:
Sliders may only tighten.
An Envelope can always be made smaller, shorter, or narrower on this screen. It can never be made larger, longer, or wider. The agent proposed a term sheet; the human's only moves are to accept it or shrink it. If a control on the page would let a slider loosen a limit past what the agent requested (more dollars, later expiry, broader scope), that is a malformed term sheet, and it is the one unambiguous signal to walk away.
That is why the screen is safe to hand to a busy human: the worst outcome from fiddling with it is authorizing less than was asked.
Where this fits in the flow
The approval URL is one specific gate in the proof-before-account flow:
- An agent discovers the platform and gets an ephemeral trial capability: no account, no card.
- It uses the free catalog, authors a Kestrel strategy, and validates it in free SIM.
- It produces certified Blotters, Grades, and a shareable proof URL.
- The paid or privileged boundary arrives as an HTTP 402 Offer.
- Commerce-only scopes settle by the agent's wallet. Legal, broker, and LIVE scopes route to a human: this screen.
- The human signs (or tightens, or declines), and the exact operation resumes.
This is not approval of a vague relationship with an agent. It is approval of one Envelope, at one gate, with a proof already attached.
When to just close the tab
The screen is designed so the decision needs no understanding of the strategy, only of the contract. Decline when:
- The worst-case-in-dollars is larger than would be acceptable as a total loss today.
- The scope is broader than the specific thing the agent is understood to be doing. Vague scope is a reason to decline, not to trust.
- There is no visible expiry, or the expiry runs far longer than the intent.
- The revocation control can't be found, or it isn't solely the signer's to press.
- Any slider can loosen rather than only tighten.
None of these require reading the strategy. They are properties of the contract, and the contract is only five fields.
Honest status
As of mid-2026: anonymous trial sims, certified Grades, shareable proof URLs, and 402 Offers with Stripe settlement are live; always-on paper presence and the human-signed live path are in build. The free tier needs no signup. The term-sheet approval URL belongs to the human-signed live path: it is part of the platform's authorization design, not a shipped consumer product anyone can sign into today. The invariants described here (mandatory expiry, one-tap revocation, downward-only authority, tighten-only sliders, worst-case-in-dollars) are the fixed rules the surface is being built to honor, stated plainly so the eventual screen can be held to them. This is an explanation of a design, illustrative and impersonal, and not investment advice.
A term-sheet approval URL is a contract you can actually read: four fields, a worst case in dollars, and a promise that every slider only tightens.