Authority model

Permission in VACT-P flows downward through a chain of signed authority. A chain can only ever narrow — a verifier computes effective authority as the intersection of every element in it, and anything that can't be represented safely fails closed.

Mandates

A Mandate is the root authorization issued by a principal — human, organizational, or hybrid — to an agent. It must include:

• Issuer and subject agent
• Granted actions and resource constraints
• Validity interval and delegation depth
• Budgets and approval rules
• Proof

A Mandate should include a human-readable purpose.

Delegations

A Delegation transfers a subset of effective authority from one authorized actor to another. It must reference its parent, identify issuer and subject, decrement remaining delegation depth, expire no later than its parent, and be signed by the issuer.

Effective-authority algorithm

A verifier computes effective authority as the intersection of every element in the Authority Chain:

effective_actions      = intersection(all action sets)
effective_resources    = intersection(all resource selectors)
effective_expiry       = minimum(all expiries)
effective_money_budget = minimum(all remaining money ceilings)
effective_compute      = minimum(all remaining compute ceilings)
effective_approval     = strongest(all approval requirements)
effective_data_policy  = most restrictive(all data policies)
effective_delegation   = minimum(all remaining delegation depths)

If an intersection cannot be represented safely, verification must fail closed.

The authorization decision

Before any protected action, the executing agent evaluates twelve checks, in order, and records the result as allow, deny, or indeterminate:

Policy semantics

Policies should be content-addressed: a reference carries a digest, policy language, issuer, effective version, and retrieval location. VACT-P Core combines policy decisions with deny-overrides — any applicable deny wins, an allow requires every mandatory engine to agree, and a missing or unrecognized mandatory policy is indeterminate.

Data-policy constraints may cover classification, permitted purpose, geography, storage destination, retention, training use, human access, derivative use, disclosure recipients, and deletion verification. A provider must reject a contract whose data policy it cannot enforce.

Revocation

VACT-P defines revocation for passports, keys, credentials, mandates, delegations, offers, contracts, leases, and settlement authorizations. A revocation object identifies the revoked object, the revoker, the revoker's authority, an effective time, and a reason code.