Authority

Authority is permission to spend or put capital at risk. kestrel.markets models it with a single primitive.

The scarce complement

When agents can generate strategies without limit, strategy stops being the scarce input — and its complements become where the value sits. Authority is the first of them. An agent can author a plan in a second, but it cannot manufacture the permission to put real capital behind that plan. Only a human signature can mint that permission, and no volume of generated strategy substitutes for it.

That asymmetry is the whole reason the Envelope splits its signers. Commerce scopes — buy a sim, buy a Grade, buy a data slice — a verified machine payer can root on its own, because the blast radius is a budget. The scopes that reach real money — a broker connection, live trading authority — terminate at a human root who signed something identity-bound and legally irreversible. The signature is the one input the agent cannot produce for itself, which is exactly why authority, not strategy, is what the platform is built to grant.

One Envelope, scope-gated signers

The Envelope is the grant. Scope is compiled into a signer requirement set, not accepted from a caller-provided label:

• Wallet may authorize commerce-only scopes (buy a sim, a Grade, a data slice). A verified machine payer can root commerce-only authority.
• Humans sign identity-bound, legally irreversible scopes — broker connection and live trading authority never extend past a human root.

Envelopes are narrowing-only (a child never widens its parent), carry mandatory expiry, and support one-tap revocation (takedown of the subtree's own orders only).

The pod tree

Budgets nest and authority narrows down a recursive pod tree: a PM pod mints narrowed child Envelopes for trader pods. In an agents-hiring-agents world the platform is the settlement-and-authority layer of that tree — with zero marketplace machinery in v1.

Epochs

An authority epoch proves a Root-derived grant is still current; a live fencing epoch proves which executor owns the live slot. Both are required to start live, and neither substitutes for the other. Revocation advances the authority epoch and blocks new initiation, retaining only bounded management of already-identified obligations.