# Authority (/docs/concepts/authority)



Authority is permission to spend or put capital at risk. kestrel.markets models it
with a single primitive.

## The scarce complement [#the-scarce-complement]

When agents can generate strategies without limit, strategy stops being the scarce
input — and its **complements** become where the value sits. Authority is the first
of them. An agent can author a plan in a second, but it cannot manufacture the
*permission* to put real capital behind that plan. Only a human signature can mint
that permission, and no volume of generated strategy substitutes for it.

That asymmetry is the whole reason the Envelope splits its signers. Commerce
scopes — buy a sim, buy a Grade, buy a data slice — a verified machine payer can
root on its own, because the blast radius is a budget. The scopes that reach real
money — a broker connection, live trading authority — terminate at a human root
who signed something identity-bound and legally irreversible. The signature is the
one input the agent cannot produce for itself, which is exactly why authority, not
strategy, is what the platform is built to grant.

## One Envelope, scope-gated signers [#one-envelope-scope-gated-signers]

The **Envelope** is the grant. Scope is compiled into a signer requirement set, not
accepted from a caller-provided label:

* **Wallet** may authorize **commerce-only** scopes (buy a sim, a Grade, a data
  slice). A verified machine payer can root commerce-only authority.
* **Humans** sign **identity-bound, legally irreversible** scopes — broker connection
  and live trading authority never extend past a human root.

Envelopes are **narrowing-only** (a child never widens its parent), carry
**mandatory expiry**, and support one-tap revocation (takedown of the subtree's own
orders only).

## The pod tree [#the-pod-tree]

Budgets nest and authority narrows down a recursive **pod tree**: a PM pod mints
narrowed child Envelopes for trader pods. In an agents-hiring-agents world the
platform is the settlement-and-authority layer of that tree — with zero marketplace
machinery in v1.

## Epochs [#epochs]

An **authority epoch** proves a Root-derived grant is still current; a **live fencing
epoch** proves which executor owns the live slot. Both are required to start live, and
neither substitutes for the other. Revocation advances the authority epoch and blocks
new initiation, retaining only bounded management of already-identified obligations.