The capability check

§5 splits authority into permission and authorization, and the order is the contract. Set who is asking and what they hold; this page runs the chapter’s checks in its own sequence — an explicit bit, the opened-by sentence, the owned-by chain, the Surface’s Role Ladder, the task grant, then the approval — and stops at the first one that answers. You get allowed, needs an approval or refused, the rule that decided, the missing bit, and who has to fix it.

§5 Identity and Capability, lines 2032–2308 · the eight checks below, rules 1–5 and 11–21 · the world is a fixture and the page reads a verifier’s answer about signatures; it never holds a key.

Who asks, and what

The principal A user or an autonomous agent. Its owned-by chain and its rung on this Surface are part of the request.

Where the act lands A capability Act governs an internal Resource; an operation verb governs an external Surface, where the Role Ladder decides (rule 5).

The Act The capability dialect’s five Acts, each a signed bit on the Resource’s row.

The resource it touches

The Surface Rule 5 compares the rung the operation needs with the actor’s rung here.

The targets Rule 13 binds exact Resource ids, never a pattern.

The catalog category Empty: the record names none (rule 16).

The task

What the principal holds

An explicit bit naming this principal One signed event, t(Actor, may | may-not, Act), for the Act above. A bit is present or absent; nothing infers it.

An explicit bit naming the whole Kind Rule 2: a grant MAY name a principal or a whole actor Kind. This one names the principal’s Kind, so it answers for any agent of it.

A task grant Rule 11: read-only actions need none; a state mutation needs one from the task, a tenant ruleset or a standing grant, and it covers only its named acts and targets.

a grant exists

How far the act reaches Rule 13: an approval may be null only for a reversible act that reaches no one. Rule 20: two acts no approval covers arrive as refusals.

irreversible reaches people

reveals a secret’s value

The approval, and the model’s opinion

an approval is present

Rule 17: at commit the act spends exactly one covering approval — same category, task and holder, every target inside it, an amount within every limit, unexpired and unspent.

Its holder

Its task

Its category

Its targets Exact ids, or a prefix ending at / or : then * — never a bare * (rule 15).

Limit usd

Expiry

Signature

already spent

The act’s usd

What a model says Rule 12: data the checker evaluates, never authorization. Nothing here can move the verdict; the trace records what it was worth.

confidence

learned policy

reputation

The checks, in the chapter’s order

#	check	§5	what it saw	result

A result of decided stops the sequence: every later row is skipped, which is why the first failing check is the one that answered. Read-only actions need no grant, so the grant row passes without one.