AUTHORITY BEFORE ACTION SOVEREIGN MISSION INTELLIGENCE AND AUTHORIZED ACTION DENY by default EVIDENCE before effect
MODULE 06 · AUTHORITY KERNEL

The only place a yes is issued.

The Authority Kernel is the single policy decision point of Verity Command. It evaluates every request to access, release or act — from people, services and AI agents alike — and either authorizes it within an explicit scope or refuses it with stated reasons. Both outcomes are evidenced.

  1. OBSERVE
  2. UNDERSTAND
  3. SIMULATE
  4. RECOMMEND
  5. AUTHORIZE OR REFUSE
  6. DISTRIBUTE
  7. ENFORCE
  8. EXECUTE
  9. EVIDENCE

What it evaluates

No module implements its own authorization logic. Each embeds a thin enforcement point that assembles the decision context and asks the Kernel. Policy is signed, versioned and testable data rather than code.

  • IdentityAn authenticated principal, device and session, verified at the enforcement point.
  • Mission scopeThe mission is taken from the authorizing grant, never from the caller.
  • Role and capabilityRole, attribute, relationship and capability models evaluated together.
  • Human approvalSigned consent bound to the exact content digest of what is approved.
  • QuorumThe number and composition of approvers required by policy for the action class.
  • ClassificationLabel ceilings and release decisions for every recipient and every output.
  • Time and leaseTrusted time within bound, and a lease that outlasts the action it covers.
  • RevocationCurrent revocation state and authority epochs; grants below the floor are refused.
  • Deny precedenceA decision is permit only if every model permits and no explicit deny matches.
  • Fail-closed behaviorInternal error, unavailability or ambiguity results in refusal.
  • Separation of dutiesRecommendation, authorization and execution use different services and credentials.

Permit and deny

PERMIT PATH

  1. Preconditions hold: identity known, policy available, trusted time within bound, evidence writable.
  2. Every applicable model permits; no deny rule matches.
  3. Approvals and quorum are complete and bound to the content digest.
  4. Classification and release constraints are satisfied for each recipient.
  5. The lease and validity window cover the execution period.
  6. The decision record is committed to the Evidence Ledger.
  7. A signed authority envelope — scoped, directional, time-bounded — is issued.

DENY PATH

  1. A precondition fails, or any deny rule matches.
  2. Evaluation continues far enough to name every unmet condition.
  3. The refusal is committed to the Evidence Ledger with the policy version used.
  4. No authority envelope is issued.
  5. Tunnel Sovereign has nothing to distribute; nothing is queued for later.
  6. Verity Edge would reject any instruction that arrived without an envelope.
  7. The requester sees each reason, and therefore what would have to change.

Decisions, illustrated

  • No provenance, no writeRecords without source and label are refused.
  • Deny precedenceOne deny overrides any number of permits.
  • Fail closedAn unavailable dependency produces a refusal.
  • Approval bound to contentEdited content needs new approval.
  • Delegation never amplifiesAn agent never exceeds its delegator.
  • Authority expiresA short lease cannot cover a long action.
DECISION STREAM · illustrativeEXAMPLES ONLY

Why fail closed

A system that continues to act when it cannot establish the basis for acting is not resilient. It is unaccountable. The Kernel therefore treats an unrecognized classification, policy identifier or category as maximally restrictive, and treats missing identity, policy, evidence or time as grounds for refusal.

That choice has a cost, and the architecture states it: the Kernel is a single point of denial. An outage of the decision path stops action rather than permitting it, and an adversary who can degrade identity, policy, evidence or trusted time can degrade the ability to act. Deployments plan for that availability risk explicitly rather than weakening the rule.

Authority envelopes

A permit produces a signed authority envelope: the content digest, the mission, the principal, the scope, the direction, the validity window and the policy version. It is the only object Tunnel Sovereign will distribute and the only object Verity Edge will accept. An envelope cannot be widened, extended or reused by the endpoint that holds it; only the issuing authority can issue new validity.

Envelopes and decision records are signed with keys managed by QECNet Trust Fabric. The Kernel itself never holds payload keys.

Related

SCENARIOAuthorization refusedThe refusal in the Hormuz reference scenario. MODULE 07Evidence LedgerWhere every permit and every refusal is recorded. VC-PUB-001Architecture noteThe authority decision path in detail.