01 / The difference
Two facts that must stay separate
A finance agent has a policy rule allowing transfers below $10,000. Its task grant permits invoice matching but no payment release. A $7,000 transfer satisfies the amount rule and still lacks authority.
Authority establishes why a principal may act at all. Policy evaluates whether an action inside that grant is allowed under current conditions. A policy rule cannot manufacture a missing grant.
First validate a live grant from an accountable origin for payment.release on the target account. Then apply amount, payee, risk and time policy to the exact request. Return a denial reason that distinguishes missing authority from a policy constraint.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision boundary
Put the check where it can stop the effect.
First validate a live grant from an accountable origin for payment.release on the target account. Then apply amount, payee, risk and time policy to the exact request. Return a denial reason that distinguishes missing authority from a policy constraint.
03 / Failure and evidence
What goes wrong, and what can be proven?
A policy engine evaluates only “amount < $10,000” and treats its ALLOW as permission to call the bank, even though no one delegated the payment operation to this agent.
Retain the originating grant and scope result separately from the policy ID, version, evaluated context and decision. Link them to the executor attempt only if execution follows.
04 / Canonical scope
Why this reference stands alone
The policy platform page explains ProofGrid policy capability. This reference owns the logical dependency: policy narrows an existing grant, while authority supplies its provenance.
Decision analysis
Evaluate the grant before the rule
A rule can say that a transfer below a ceiling is acceptable, but it cannot establish that the agent was delegated transfer authority. Keep the two failures distinguishable in the decision contract.
- Grant absent
- DENY even when policy would otherwise allow.
- Grant present; amount above ceiling
- DENY because policy narrows the valid grant.
- Grant present; rule allows; parent revoked
- DENY because authority is no longer current.
Negative test
Remove the parent payment grant while leaving the $10,000 policy rule intact. The same $7,000 request must change from potentially ALLOW to DENY. A policy-only evaluator would miss the withdrawal.
Primary references