Zero-trust identity inheritance: an agent's effective authority is the intersection of its delegator's authority and the explicit grant — delegator ∩ grant. A grant can only narrow: it can never hand the agent a scope or a spending limit the delegating human doesn't hold. Edit the three and watch the gate.
Honest scope. A deterministic, signable governance primitive in the kernel family. It is the SAP-PFCG / "the agent inherits the human's limitations" rule, vendor-neutral — the scope/limit complement to the signing-limit and four-eyes kernels. It decides whether a request is within authority; it does not move money or call any system. Primitive + demo. Source: flowdesk-authority-kernel.js.