<!-- SPDX-License-Identifier: Apache-2.0 -->
**Status:** stable · **Owner:** Developer Relations · **License:** Apache-2.0

# Playbook 2 — Authority Finality

> The end-to-end recipe an agent follows to turn an instruction into a
> **defensible, replay-verifiable action**:
> `discover → authority → purpose → evidence → finality`.
> This is the conceptual spine the KYE Authority Finality™ diagnostic scores.

## 1. The problem

An agent can be *capable* of an action without being *authorised* to perform it.
"Authority Finality" is the property that, at the moment of execution, the agent
has resolved a concrete chain of authority, bound it to a declared purpose, and
sealed the evidence — so the decision is final, attributable, and replayable. An
agent that acts without finality is an audit liability no matter how good its
output is.

## 2. The pattern — five stages

```
(1) DISCOVER   what could act?        → resolve the principal + the agent identity
       │                                 (every action attributes to exactly one
       │                                  principal in one tenant)
       ▼
(2) AUTHORITY  is it allowed to act?   → resolve the authority grant + scope
       │                                 (delegation chain → capability → scope)
       ▼
(3) PURPOSE    why is it acting?       → bind the action to a declared purpose
       │                                 (Purpose Permission™ — purpose + scope rail)
       ▼
(4) EVIDENCE   prove it happened       → emit the §0.3 evidence family
       │                                 (decision_map + tool_call + evidence_pack)
       ▼
(5) FINALITY   seal it                 → context-seal + replay-proof, verifiable
                                          from public keys alone
```

Each stage answers one question. If any stage cannot be satisfied, the action
does **not** proceed — finality is all-or-nothing.

### Stage-by-stage, provider-agnostic

| Stage | Concept | The agent's job |
|---|---|---|
| Discover | principal + agent identity | name *who* acts; attribute to one principal in one tenant |
| Authority | authority grant + scope | resolve a delegation/capability that covers the action; nothing implicit |
| Purpose | Purpose Permission™ | declare the purpose the action serves; scope it down per-task |
| Evidence | §0.3 evidence family | emit decision-map + tool-call + evidence-pack envelopes |
| Finality | context-seal + replay-proof | seal the bundle so it is reconstructable later |

The first three stages are *inputs you supply*; the last two are *outputs the
KYE pipeline produces* from those inputs.

## 3. The public artefacts

The conformance contract for stages 1–5 is published as the profile examples:

- [`public/examples/profiles/core.json`](../../examples/profiles/core.json) —
  the seven-question contract every privileged action satisfies.
- [`public/examples/profiles/runtime-authority.json`](../../examples/profiles/runtime-authority.json)
  — `Decision` is `authorised_by` exactly one `Authority` and `scoped_to` a
  `Scope`, bound to a `Purpose`.
- [`public/examples/profiles/evidence-replay.json`](../../examples/profiles/evidence-replay.json)
  — the evidence + replay stage.

The five locked relationship verbs (`authorised_by`, `scoped_to`, `requires`,
etc.) come from the public
[JSON-LD context](../../examples/jsonld-context.json).

Authority Finality™ is also scored as a developer self-check by the
[KYE Authority Finality™ Claude Code plugin](../kye-claude-code-plugin/) and the
hosted [diagnostic](https://kyeprotocol.com/diagnostic.html).

## 4. What stays KYE-side

This playbook discloses the **five-stage recipe** and the public profile
contracts. The *resolution algorithm* for stage (2) — how a delegation chain is
walked, attenuated and ordered — and the *seal construction* for stage (5) are
patent-track and never appear here. Your agent provides the principal, the
authority reference and the purpose; the KYE Reference Gateway™ resolves, decides
and seals.

## Next

- Playbook 3 — [policy-resolver-integration](./policy-resolver-integration.md):
  feed an existing policy engine's verdict into stage (2).
- Scaffold it: [`governed-agent` template](../agent-dev-kit-templates/governed-agent/).