Economics and standing

What the money was

The decision knows a payment was permitted. The record knows it happened. Neither knows what it was. Nothing else in the stack separates revenue from principal, from a refund, from an operator moving their own funds between their own accounts.

Movements are classified into a fixed set of kinds, and the classification only ever downgrades a claim rather than promoting one. There is an explicit indeterminate outcome for movements that have no correct kind, because forcing a label is worse than admitting there isn't one.

Was it actually allowed

The payment layer can be measured for authenticity, and the honest figures come in well below the headline ones. The authority layer has had no equivalent: an identity can be dormant, a reputation score can be coordinated, and a payment can be entirely real while nobody can show the agent was permitted to make it.

Authority coverage measures that directly. Over a declared population of executed payments, what share ran under a mandate that was verifiable, unexpired at the moment of execution, in scope, unrevoked, and where version-bound, version-matched.

Caps that respond to standing

A fixed cap answers how much and never on what standing. Several inputs make the effective cap a function of standing instead: how fresh the agent's evidence is, how far its behaviour has drifted from what it said it would do, whether its spending is converting into anything, and what kind of claim the asset actually is.

Every one of them reads structured numbers only, never model text, and every one can only tighten. None of them can grant more room than the operator did, and the reason string carries the numbers the decision turned on so a third party can replay it.

Supplying the empty half

The registry side of this market is lopsided. Identities register in volume, what reputation exists concentrates in a handful of wallets, and the validation side is close to empty. We already produce the thing that empty half wants: an enforcement record that replays or does not.

So the emit path supplies validation evidence, and the direction matters: we publish into those registries and never consume them as an input to a decision. Anything read back stays a hint and never reaches the gate.