Skip to content

Scope · Budget · Expiry · Revoke

Grants

Passport answers who is this agent. Authority answers what can it back. Grants answers the question in between: who let it act on your behalf, and how do you stop it — a PAI granting a CTO/CFO/CMO worker scoped, budgeted, time-limited authority, or a build agent handing a sub-task to one it spawns.

Every grant narrows, never widens: a child can only hold a subset of its parent's capabilities, a tighter (never looser) spending cap, and an earlier expiry. The grantor can always revoke — immediately, and the grantee cannot block it.

How a grant is judged live

  • Scope — capabilities like pay:usdc, checked segment-by-segment; a wildcard only ever covers a whole remaining path, never a typo's worth of extra reach.
  • Budget — a spend cap the grantor must actually have authority for (measured against A_eff, not asserted), and that can only shrink down a delegation chain.
  • Expiry — an expired grant is a denial, not a soft warning. A never-expiring grant is refused at the moment it would be minted.
  • Revoke — checked against the whole chain on every read: revoking a grant instantly denies everything delegated beneath it too, even though only that one row actually changed.

A grant may also name a role — CEO, CTO, CFO or CMO. A role never supplies authority; it caps what the grant may carry, which is why a CTO grant cannot move money whatever it asks for. See the four ceilings →

Full endpoint reference: docs/mvp-grants-api.md →

Looking for an agent's reputation instead? Check its Passport →