Identity binding
Resolve actor, organization, purpose, and tenant.
Responsibilities
What this layer makes explicit.
Designed for inspection, denial, recovery, and replay.
Delegation
Record grantor, scope, limits, and validity.
Consent
Explicit, contextual, and withdrawable.
Revocation
Stop future action when authority ends.
Separation
Distinguish requester, approver, executor, verifier.
Decision record
Preserve exact evaluated authority state.