Authority is one primitive
Most systems accumulate a pile of permission concepts — tokens, API keys, roles, scopes, flags — and the security story is whatever emerges from how they interact. Kestrel refuses that. Authority — permission to spend money or put capital at risk — is a single primitive: the Envelope. If an agent can do it, an Envelope authorized it; if no Envelope covers it, it does not happen. The authority reference gives the exact definition; this unit teaches why one typed grant, enforced by the runtime, beats any amount of good intent.
What an Envelope is
An Envelope is a signed grant of a fixed shape:
{ scope, budget, ceiling, expiry, revocation }- scope — what the grant permits (buy a sim, read a broker, trade live).
- budget — how much may be put at risk.
- ceiling — the hard cap the grant may not exceed.
- expiry — when the grant dies. Mandatory; there is no forever.
- revocation — the ability to end it on demand.
It is attached to a node of the pod tree — the recursive structure where a PM pod mints narrower child Envelopes for the trader pods beneath it. The grant is not a description of what an agent should do; it is the boundary the runtime checks before letting it act.
Three properties that make it safe
The shape is simple, but three rules give it teeth.
Narrowing-only. A child Envelope can only ever be tighter than its parent — smaller budget, narrower scope, sooner expiry. Authority shrinks as it flows down the tree and can never widen in place. So no matter how deep the pod tree grows, no leaf can hold more authority than the root granted, and delegation can only ever subtract.
Mandatory expiry. Every Envelope carries an end. There is no such thing as a grant without an expiry, which means stale authority cannot quietly accumulate — the default state of the world is no permission, and every grant is a temporary exception that lapses on its own.
One-tap revocation. A grant can be pulled immediately, and revocation takes down only that subtree's own orders — it stops new initiation and retains only the bounded management of obligations already identified. Killing a grant is a scoped, surgical act, not a system-wide panic button.
Why a type beats a policy comment
The deepest idea here is that authority is a type the runtime enforces, not a
policy comment an agent is trusted to obey. A comment that says "don't risk more
than $500" is worth exactly as much as the agent's discipline in reading it. A
budget field on an Envelope is checked by the runtime at the moment of action —
the trade that would breach it simply cannot be admitted. This is the same shape
you saw in a Plan, where budget makes risk a type and ttl expires the
authority: authority in Kestrel is never advisory. It is structural, and structure
does not have a bad day.
See it in kestrel
Run a bounded session and watch a Plan act inside its authority, then account for exactly what it spent:
npx kestrel.markets sim mean-reversion-range-fadeThat runs a deterministic simulation over a generic range-bound session — managed licensed data, no wall time, no signup, no card — and prints a certified proof URL. Point the CLI back at the proof and it recomputes the whole record on your own machine, byte for byte:
npx kestrel.markets certify https://kestrel.markets/proof/art_f576347572a410a52647cf90Keep it one command away: drop the kestrel.markets MCP server into your client and the next session is already wired up — no account in between.