Skip to main content

​
Opt the parent in first

Delegation is off by default. A grant cannot hand authority onward unless it was issued with delegation_policy: "attenuating", because the right to delegate is itself a right somebody has to grant.

​
The call

Every field must be narrower than or equal to the parent. Ask for more on any dimension and the call fails. Not a warning: the grant is not created and the pipeline does not start.

​
What you cannot do, and why the API says no

The obvious one. Refused.
A child outliving its parent is an authority with nobody above it. Refused.
You cannot grant what you were not granted. Refused.
A child in observe under a parent in enforce would be a hole straight through the control. Refused.
If the parent requires a clean context, the child requires it too. Refused.

​
The ceiling is on the tree

Give five children £5,000 each under a £25,000 parent and the tree can still only spend £25,000, because every leaf debit lands on every ancestor. Which produces the behaviour worth rehearsing before it surprises somebody:
A child with room in its own allowance is refused, because an ancestor is exhausted.
That is exhausted, not deny, and it is correct. The child’s own allowance was never the operative limit.

​
Rehearse the revocation

Do this once, in a controlled window, with somebody watching:
  1. Start a delegated pipeline.
  2. Revoke the parent grant mid-flight.
  3. Watch what the child does next.
Whatever happens is what will happen on the bad day. Then ask the record what was permitted between the revoke and the last child stopping, because there is always an interval and “we revoked at 14:02” does not answer “what did it do at 14:03”.

​
Record the handoff even without a new grant

Useful where the child runs under the same authority: the trajectory still shows where work changed hands.