Resolve the grant from the record, not from the caller

The chapter’s claim is that the grant that authorized an effect is one the record establishes. A caller that supplies its own authority is not a source of permission: it is a claim, and the runtime decides the claim from the directive chain it has recorded.

Run it

git clone https://github.com/ernanhughes/codeai.git
cd codeai
git checkout c1707f793abbd6042dce7d00b6dde34f2dbf33cc
PYTHONPATH=src python examples/applied_ai/ch20_authority.py

CodeAI has no runtime dependencies, so nothing needs installing. Python 3.11 or later. No model is called and nothing leaves the machine.

Expected outcome

The chain resolves from the recorded parent, and the effective grant is the narrower one:

resolved chain  : review-child -> review-root
effective grant : {'write'}

A capability the child never held is denied, and a caller’s forged grant is denied too — the adapter ran exactly once, for the request that was actually allowed:

write           : succeeded
destructive     : denied  (capability denied: destructive)
forged grant    : denied  <- the caller's claim is not consulted
worker calls    : 1

And the authorized action records where its permission came from:

authorized basis: recorded_directive, 2 events

The rule, and the reduction

The program prints its own reduction of the chapter’s rule:

    grant = runtime.directive_authority(request.directive_id)
    if not grant.allows(request.capability):
        refuse(request, grant)
    else:
        record_authorized(request, grant)
        execute(request)

The check underneath it is a set membership test, and the narrowing rule is a subset test — a child directive may hold less than its parent and nothing more:

class Authority:
    capabilities: frozenset[Capability] = frozenset()

    def allows(self, capability: Capability) -> bool:
        return capability in self.capabilities

    def narrows(self, parent: Authority) -> bool:
        return self.capabilities.issubset(parent.capabilities)

Mechanism and limitations

Documented: the reduction above is in the program’s docstring in examples/applied_ai/ch20_authority.py; Authority.allows and Authority.narrows are in src/codeai/domain.py; the registration path that reconstructs a parent’s budget and authority is Runtime.open_directive in src/codeai/runtime.py.

Observed: the run above. The chain resolved child-to-root, the effective grant was {write}, a destructive request was denied, and a request carrying a caller-supplied DESTRUCTIVE authority was also denied — the worker was called once, for the write. The authorized action recorded recorded_directive and two basis events.

Not shown. This run shows a two-level chain with a single capability difference. It does not exercise budget widening, a missing parent, or the capability ACCEPT; those are separate probes. A request that names no directive falls back to the caller’s authority by design, so the rule is “the record decides when the record has something to decide” — not “the caller is never consulted”. The boundary is the runtime’s mediation of a recorded directive, not authentication: the demo opens the directives itself.

Canonical source and the CodeAI domain .