---
title: "ADR 0007: Authority is resolved from immutable attenuating records"
description: "Keep identity, membership, context, capabilities, delegation, expiry, and revocation explicit and fail-closed."
navLabel: "ADR 0007"
order: 107
nav: false
eyebrow: "Decision"
status: "accepted"
theme: "main"
visibility: "public"
---

## Context

`pre.action.v1` carries participant, acting identity, context-grant references, claimed authority, and caller-visible risk. None of those caller-supplied fields can be trusted as permission.

## Decision

A trusted authority store admits immutable identity bindings, memberships, context grants, capabilities, and revocation records. The resolver reads only that admitted state.

Capabilities and context grants bind a subject to exact actions, targets, fields, risk ceilings, and time windows. Delegated children must attenuate every parent dimension. A child cannot widen action, target, field, risk, time, or delegation depth.

Revocation is a separate immutable record targeting a prior authority record. Revoking any ancestor invalidates its descendants without rewriting history.

Address syntax remains non-authoritative. Membership provides an addressable subject for explicit grants; a role name alone grants nothing.

The trusted boundary reclassifies risk. Caller `riskClass` and `claimedAuthority` are inputs to inspect, never decisions to accept.

## Consequences

- possession of a capability address does not confer the capability;
- schema-valid authority records are not self-authorizing;
- field-level disclosure and action authority are first-class;
- delegation is monotonic attenuation rather than copied ambient privilege;
- revocation remains attributable and reconstructable;
- an authenticated authority store, not the action envelope, defines admitted authority state.