Glossary

Authority layer

A control plane that authorizes each high-risk action at execution time — not via standing credentials or after-the-fact logs.

An authority layer sits between identity (who can reach a system) and execution (what actually runs). It evaluates each proposed high-risk action — refunds, dispatches, delegations, credential changes — and returns ALLOW, DENY, or APPROVAL_REQUIRED before downstream APIs execute. Unlike IAM, which grants standing access, the authority layer answers whether this exact action is authorized right now.