Things we say cannot happen.

a Card's amounts are counted in its own currency only.

once KIFF accepts a phone's signature for another service, that service saves the account's contract and permit targets with the phone's session, each once, within a minute, and nothing else (kiff/tafs#206).

the owner's halt binds in observe mode too. Observe makes KIFF's decisions advisory while an account watches what enforcing would do; a halt is the owner stopping an agent, not a decision to watch.

while the owner has halted an agent, or its whole account, KIFF decides none of its calls: a new call, a retry of one decided before and a held call asked again are all refused (halted), so nothing is sent and no permit is issued. Once resumed, only new calls go through: what was asked before the halt stays refused.

a hard refusal has nothing to approve. A call past a Card set to refuse is refused with no held call behind it, so the owner's list shows nothing to answer, and approving it by its call's id finds nothing.

a phone's approval key is replaced only when its own person approves the new key in their browser, after the new key proved itself.

a person's run grant goes with each call KIFF decides, and a grant KIFF refuses sends nothing. The gateway never decides on the grant itself: only KIFF can say who it is for.

a trial (agent~trial) reads and halts as its agent, so planque, which asks KIFF about a trial permit's subject, refuses a trial's calls under its agent's halt, and after a resume a trial permit issued before it.

a write whose vendor answer doesn't match what KIFF decided is flagged and its operation paused.

a write that doesn't carry its amount is limited by the amount its resource has, as KIFF reads it.

a revision draft changes an agent's Cards only when an owner confirms it, all of them or none, keeping each revised Card's usage so its totals don't start again, and it gives no key.

a key bound to an agent cannot author a domain, export or delete the account, or choose what it is for, even when it holds the admin role.

a key bound to an agent never holds the tenant_owner or admin role.

an agent's own key cannot issue, share or answer for a Card, even when it holds the admin role.

a key bound to an agent cannot mint, grant or revoke keys, even when it holds the admin role.

a key bound to an agent reads only the Cards that agent holds, alone or shared; another agent's Card is not listed and its statement is not found, even by its id (#1034). An agent's gateway key does not reach these routes at all.

reading its Card gives an agent's key no way to change one.

no key bound to an agent, and no runtime key, reads held work: not the list of card exceptions and not one by id, whoever's agent it belongs to or whichever Card it breached, shared or not. Held work carries the call's parameters and the Card's limits (#1036).

no key bound to an agent, and no runtime key, watches the account's live decisions: it cannot subscribe to the event stream, so it never receives another agent's decision (#1036).

through the real router, agent A's key reads only Cards agent A holds: not agent B's, by list or by id; a Card they share is visible to both. People and account keys read every Card (#1037, #1036).

a tool that checks KIFF's execution permit never receives an allowed call without one, and that call is reported as not sent.

another KIFF service takes a person's act signed on their phone only when KIFF confirms that phone signed that exact request, once, and the person may connect tools (kiff/tafs#206: connecting the account's control server through the gateway).

A caller cannot escalate its own authority by decorating the actor it submits. Authority is resolved from policy-owned membership keyed by actor id; the roles on the request body carry no authorization power.

an agent's own key cannot grant or deny an approval, even one it may review by role or by grant.

a key cannot grant or deny an approval it asked for, even when it holds the reviewer permission.

approve once authorizes exactly one action, the one the owner saw, and does not raise the Card. That action still counts in full toward the Card's totals.

the agent's Card read answers only a key bound to an agent; a person or an unbound key has no agent whose Card it could show.

a subject cannot exceed its cumulative limit, however many individually-permitted actions it proposes. Per-action ceilings bound one mistake; this bounds the day.

a call made under a trial its owner started is decided on the trial's Cards alone, drawing on them, and recorded under the trial; a call without it never sees them. Once the trial ends, its calls, held ones included, are refused.

an API key cannot approve a device sign-in, so an agent's key cannot turn itself into an owner session.

A caller cannot grant itself a permission by putting a role on the actor in the request body. The execute gate resolves roles from policy, never from the payload.

An API key past its expiry authenticates nowhere: every route the API registers answers 401 to it, an account key's and an agent's alike, as it does to a revoked key.

an expired or revoked mandate never widens authority. It is reported as expired rather than falling through to "no mandate applies", which would turn an expiry into a grant.

an external approver's answer cannot go past its grant. Over its per-call ceiling, outside its Card, past a total, after its grant is withdrawn or expires, after the Card changes, or for its own call, the answer is refused and the hold stays as it was.

a tool cannot speak for KIFF: it cannot write the dev.kiff/ result metadata that clients rely on.

a gateway key is always bound to an agent. Neither creating a key nor adding a role to one yields a gateway_agent key without an agent.

a trial's writes through the gateway get the decisions the same queue of real calls would get from the agent's Cards, each counting the trial's earlier allowed writes, and KIFF records nothing real for them: no draw, no held call, nothing for the owner to answer.

Work held for a Card's owner is refused once its hold expires unanswered, and stays refused.

A runtime key cannot manage keys. Credentials issued for calling the decision API cannot mint, rotate, or revoke other credentials.

a lifetime total never resets. Calls across days draw on one total, so a daily-looking budget cannot be spent once per day.

reissuing a Card cannot reset its lifetime total, not by moving ValidFrom later and not by switching a daily total to a lifetime one: every draw the Card has made counts.

a sign-in token issued through one connect link works only at that link's URL.

a mandate that sums a parameter an action does not declare as numeric is refused when it is issued, not discovered at runtime.

only Setup's key reads another agent's Card through kiff_card; a taf's key that names another agent is refused, and reads nothing.

only Setup's key reads another agent's Card; a taf's own key sees only the Cards it holds, whatever agent it names.

an action outside a Card set to come home is held for the Card's owner and authorizes nothing until the owner answers.

an agent's gateway key pasted into a client reaches the same routes as an OAuth token for that agent, and only the two its own runtime needs besides (a person's access to that agent, and resolving their run grant): not the account's Cards, held work, event stream, agents or export.

reading the list of pending calls decides, draws and sends nothing, and an agent's key sees only its own calls.

one action cannot carry more than the per-action limit, however much the Card's total has left.

revocation cannot be undone by re-issuing the same mandate id. Authority that was withdrawn stays withdrawn until a new mandate is issued under a new id.

A read-only account key (role viewer, bound to no agent) reads the account's activity, held work and stream, and changes nothing: every write route the API registers, including ones added later, refuses it before any handler, and so do reads that need more than reading (the export, the audit log). The same role on an agent's key leaves it that agent's runtime key.

a refusal's next step is one the held call's own Card offers, and it stays a refusal: nothing is drawn, the call ends, and the agent can read what the owner asked it to do instead.

every spelling of kiff_card is the gateway's own tool. A tool connected under one before the name was reserved is neither listed nor reached.

a call on a resource outside the Card comes home to its owner, and an approval covers that exact resource only.

a Card scoped to named resources authorizes the action only on those resources.

an unscoped Card covering the same action never widens a scoped one. Cards are conjunctive, so the scope binds.

a runtime credential cannot issue or revoke a mandate. A key that could grant itself authority would make every limit advisory.

a runtime key (an agent's key, or any key without the account roles) cannot read the account's activity, settings or people's things, nor change them: the decision stream, evidence, receipts, proof packs, usage, alert targets, billing budget, notification preferences, support tickets, the key list (#1036).

Setup's key acts on the account's own control server only on a Card of its own (Coach's), and still never on a vendor's tool that writes.

Setup's Card for its reads is issued only on the owner's approval of that connection, which KIFF checks itself (the device's signature over planque's approve request, a person who may connect tools, signed within a day), only by the connector key that connected the tools, and only for tools marked read-only. It allows a few reads a day and refuses past them.

Setup's key (setup_reader) reads a read-only tool only on its own read Card, and can't call a tool that writes, whatever Card names it.

where several mandates cover one action, the tightest binds. Issuing an additional mandate can only narrow authority.

a trial its owner started sends its calls (kiff/tafs#173). With KIFF-Trial naming a draft KIFF says is being tried, a call goes the normal path: recorded, decided with the draft named (so KIFF decides it on the trial's own Cards), sent when allowed, held when not, and its result names the draft. KIFF-Trial-Run isn't needed, and is harmless.

a version being tried is decided on its own trial Cards, and the live version on the agent's Cards, each with its own counters. Trying it changes nothing on the live Cards, and no call made for the agent sees a trial Card.

a trial of an agent's next version is decided against the Cards as a real queue would be, its own earlier allowed writes counting toward the limits, and draws nothing real, holds nothing and asks no owner.

a trial ends for good: going back, its runtime's sweep, or a new trial revoke its Cards, and only the agent's own key or someone who manages Cards can end it.

installing a version being tried issues its Cards live and revokes its trial Cards, together, and the trial records that it was installed.

a trial's call is never sent, reads included. A call made with KIFF-Trial is decided against the agent's Cards and answered with that decision; it creates no invocation, records no request, draws nothing and never reaches the tool.

an approval not yet used stops authorizing when its Card is revoked, moved to another holder, or expires.

a held or refused call never reaches the tool. A call is forwarded only on an allowed decision: inside the Card, or an approved per-action exception that still fits the Card's totals.

an account's drafts are its own. Another account's person can't read, confirm or discard one by its id.

one account cannot see, test, remove or decrypt another account's tool connections.

One tenant's API keys are never visible to another. Key listing is scoped at the storage boundary, not filtered after the fact.

Two tenants recording byte-identical facts commit to different Merkle leaves. A public anchor cannot be used as a confirmation oracle for a guessed record without also guessing that tenant's salt.

a literal copy of a tool's credential in its result is removed before the result is stored, returned to the agent or replayed.

a connected tool cannot point KIFF at internal, loopback, link-local or cloud metadata addresses.

A receipt altered after signing fails verification against the anchored root. Tamper-evidence is checked, not asserted.

A trace containing more than one execution is refused rather than turned into a receipt. A receipt describes exactly one executed action or it is not issued.

The bytes a receipt's signature commits to are pinned to a fixed encoding. Reordering a field would otherwise change every future hash while leaving past receipts verifiable, which is indistinguishable from tampering.

A tool that ran more often than the gate was consulted is reported as undecided calls. Bypass is measured against recorded decisions rather than assumed absent.

a call already sent, or whose outcome is unknown, keeps its recorded outcome and key when the same operation comes again and its amount can't be read now.

an approved call is sent to the tool once, however many retries race to collect it.

When a source behind the evidence object is unavailable, that section is marked unavailable and the rest still answers. Evidence degrades section by section rather than failing whole or, worse, reporting an empty section as a clean one.

a call whose delivery is in doubt is reported as unknown and is never sent again by KIFF.

When two first sign-ins for the same subject race, exactly one tenant survives and the loser cleans up the one it provisioned. No orphan tenant is left behind.

When the usage limiter cannot establish its own state, the request is allowed. Blocking a customer's production traffic because our meter was uncertain is the worse failure, and this default is deliberately the opposite of the governance one.

when current usage cannot be established, the proposal is refused. A mandate is the authority itself, not a meter, so allowing when uncertain means acting with authority nobody could confirm.

If the audit write fails, the mutation does not happen. A suspended tenant with no audit record is not an outcome this system can produce.

planque confirms a halt by reading it back with its connector key, and that read never asks planque to confirm again, so one halt is one confirm, not a loop.

if KIFF cannot record that a call was requested, the call is neither decided nor sent. A call with no record never reaches a tool.

only the account's connector key says a vendor signed a connection out, and each sign-out alerts once an hour at most.

an approve-once waives a Card's total only when it is a count of 0 the owner reviewed on that hold ("Each call asks you first"), and only for that call: the call counts as used, and the next one asks again. A non-zero total, or any money total, is never waived by approving once.

reading the Card is not a governed call. It is answered by the gateway: nothing is recorded, decided, drawn or sent to a tool.

an approval cannot carry an action past a Card's total. If the total has no room when the approved action is retried, it waits and nothing is authorized.

no bonus without its audit entry. If the entry can't be written, the bonus is taken back.

sharing a taf lets someone use it, not read the account (RFC 050 decision 12). A person reads every call and hold of the tafs they manage, their own runs' calls, and, when they may answer holds, the holds of the tafs they use; an admin, or a person on an account from before roles, reads all of it.