The account changes after approval. The recheck catches it.
- BindWho, for whom, and the exact action. Exact action fixed
- DecideMandate, your policy, a person. Allowed and approved
- GrantRecheck, then single-use authority. Account ····4821 → ····9930
- ConfirmRead the system back. Nothing to read back
- ProveA signed, hash-chained receipt. No execution receipt
Decision BLOCKED
Execution NOT_DISPATCHED
Outcome –
How one action is decided
The request becomes one action, fixed by a fingerprint, together with the agent, who it acts for, and the exact mandate in force. Revoking that mandate means an earlier decision no longer covers the action. Your policy engine is consulted, and any approval is bound to that exact fingerprint. Just before it runs, authority is checked again and what was approved is compared, field by field, with what is about to run. Only if nothing material changed is a single-use grant issued, bound to that action and to the bridge presenting it, and valid for at most 300 seconds.
What each action leaves
Every record carries the fingerprint of the one before it, so changing any record breaks the chain from that point. The receipt carries an Ed25519 signature, and a separate verifier can check the signature and the chain without trusting the rest of Delegrity. Sending is not the same as doing: until the business system's result is read back, the outcome stays unknown. A development system may run without a signing key, and its receipts then say unsigned.