18 July 2026 · KYE Protocol™ · Doctrine · ― Is Not Authority

A Permit Is Not Authority.

A runtime guardrail can allow or block an agent's action in milliseconds. Useful — but a permit checks the action, not the right to take it.

See action admissibilityMore doctrine

A Permit Is Not Authority, point by point

Demo data

You learn: The page's points, one at a time. You can: Step through them.

  1. Step 1 of 3

    KYE Protocol™

    Allow, block, or ask on a tool call or side effect.

  2. Step 2 of 3

    KYE Protocol™

    Fast policy checks against the shape of the action.

  3. Step 3 of 3

    KYE Protocol™

    A hard stop for actions no one should ever take.

How this widget is built
Demonstrates
KYE Protocol™
Components
  • The points this page makes
Flow
Each point in order, as the page sets it out. Architecture diagram
Used on

A permit says this action is allowed. Authority says this principal may take it, here, now, for this purpose.

What a permit gives you

An action firewall enforces a rule at the moment of the call.

  • Allow, block, or ask on a tool call or side effect.
  • Fast policy checks against the shape of the action.
  • A hard stop for actions no one should ever take.

This is real enforcement, and every serious agent needs it. But a permit reasons about the action in front of it — not about who is behind it.

Where it stops

A permit answers "is this action allowed?" — never "may this principal take it?"

The same wire transfer can be admissible for a treasury agent under one delegation and forbidden for a support agent under another. A permit that only inspects the action treats both callers alike; it has no model of the delegation chain, the purpose, or the expiry behind the request. Allowed-in-general is not authorised-for-this-actor, and the gap between them is exactly where an over-scoped agent slips through.

  • It scopes the action; it never scopes the actor.
  • It is stateless about delegation — no grant, no purpose, no expiry.
  • A permitted action by the wrong principal is still a breach.

The line

Authority binds the action to the principal's actual delegation, at the boundary.

KYE Protocol™ resolves who the actor is acting for, what authority that principal delegated, and whether this action falls inside its purpose and scope before returning admit or deny — then seals the verdict into a replay-verifiable Evidence Pack™. That is Authority Finality™: a permit clears the action, and Authority Finality™ decides whether this actor was ever entitled to attempt it.

Honest scope

KYE Protocol™ proves authority, not safety.

It does not replace your guardrails; a dangerous action should still be blocked by a permit regardless of who asks. What KYE Protocol™ adds is the authorisation verdict a firewall cannot form — bound to the principal, provable after the fact. Keep the permit. Add the authority.

A permit says this action is allowed. Authority says this principal may take it, here, now, for this purpose.