Authority
One Envelope, two signer classes, narrowing-only, mandatory expiry — the pod tree.
Authority is permission to spend or put capital at risk. kestrel.markets models it with a single primitive.
One Envelope, scope-gated signers
The Envelope is the grant. Scope is compiled into a signer requirement set, not accepted from a caller-provided label:
- Wallet may authorize commerce-only scopes (buy a sim, a Grade, a data slice). A verified machine payer can root commerce-only authority.
- Humans sign identity-bound, legally irreversible scopes — broker connection and live trading authority never extend past a human root.
Envelopes are narrowing-only (a child never widens its parent), carry mandatory expiry, and support one-tap revocation (takedown of the subtree's own orders only).
The pod tree
Budgets nest and authority narrows down a recursive pod tree: a PM pod mints narrowed child Envelopes for trader pods. In an agents-hiring-agents world the platform is the settlement-and-authority layer of that tree — with zero marketplace machinery in v1.
Epochs
An authority epoch proves a Root-derived grant is still current; a live fencing epoch proves which executor owns the live slot. Both are required to start live, and neither substitutes for the other. Revocation advances the authority epoch and blocks new initiation, retaining only bounded management of already-identified obligations.