Roles and authority

Section 2 of 22

Authority belongs to an assignment

Use these actor names throughout the state tables:

Actor	Meaning and limits
Contributor	An independently acting person, agent, or person using agents. May also be a member. Submission alone grants no execution authority.
Member	A participant eligible to exercise the specified challenge or governance rights. Membership alone does not grant a treasury or deployment key.
State controller	Software that checks transition conditions and records the resulting state. It cannot waive a requirement because a worker reports difficulty.
Maintainer	The authorized role that scopes work, approves assignments within its budget, and handles implementation acceptance where judgment is needed.
Policy or corpus council	An authorized evaluator of test expectations, policy interpretation, or unresolved coverage. Its assignment determines which question it can decide.
Runner	A worker authorized to execute identified tests and provide the required evidence. It has no general release-approval power.
Challenge council	The separately assigned authority that decides a qualifying challenge within a bounded appeal process.
Executor	A worker with permission to perform a specific merge, provisioning action, contract call, or payment after authorization.
Guardian	A key or process authorized for specific protective actions. Its ability to stop issuance does not imply permission to admit arbitrary new code.
Governance authority	The authorized members or stated founding arrangement that adopts rules and grants or replaces consequential permissions.
Report authority	A delegated role that determines report eligibility, defect attribution, and awards within published terms.
Budget authority	A delegated role or governance body that approves the relevant allocation or discretionary remedy. Budget-controller software enforces its limits and reservations.
Operations worker	A scoped executor that provisions services, reconciles provider state, and performs authorized recovery.
Incident coordinator	The assigned role that tracks containment, restoration, notices, and follow-up. Coordination alone grants no extra transaction permission.

An external AI contributor and a DAO executor may run similar models. Their authority is entirely different. An executor's permission comes from its role and key assignment. Running an agent in a protected environment does not grant it DAO authority. A contributor can supply useful evidence without receiving any such key.

Independence must be stated relative to a task. The author of a change cannot supply an independent challenge ruling on that change merely by running another agent. A council also cannot grant itself wider authority. Requiring independent input is justified for specific decisions, not for every routine machine action.

Use separate dimensions

Classify each step along the dimensions below. Evaluation can be full, targeted, or unnecessary for a record-only action. Authority, evidence source, and execution mode describe different properties.

Dimension	Values to record	Why it matters
Work performed	Submission, computation, judgment, execution, or observation.	Identifies what actually happens. One logical step may contain distinct jobs of different kinds.
Evaluation depth	None, targeted, or full.	Measures the scope of substantive checking. Mechanical input validation still applies when depth is none.
Input source	Contributor, DAO worker, member, provider, or several sources.	States where evidence comes from. It does not establish authority.
Decision authority	Existing rule, delegated role, challenge authority, or governance.	Determines what can authorize the transition.
Execution mode	Event-driven, deliberate submission followed by automation, or exceptional human operation.	Separates making a decision from transporting or executing it.
Effect	Record only, bounded spending, test deployment, production exposure, irreversible action, or rule change.	Helps determine permissions, delays, and recovery requirements.
Timing	No additional wait, evidence collection, challenge window, execution delay, or payment observation.	States why the transition waits and what ends that wait.

These dimensions are independently useful, but not every combination should be allowed. For example, a record-only observation needs no treasury signature. An irreversible production action needs the appropriate authority even if no new judgment is required. A contributor-supplied report does not acquire decision authority merely because its schema is valid. The targeted evaluation path is the light path discussed in earlier drafts.

A challenge window is an explicit transition requirement selected because of the action's effect and the opportunity needed to detect errors. It does not follow automatically from whether an AI performed the work or whether the evaluation was full.

For the compact tables below, work codes are S for submission, C for computation, J for judgment, X for execution, and O for observation. Evaluation depth is written in words. A row containing C and J identifies both computation and judgment. The row states when judgment is required. Full candidates require a scoped coverage decision before merge. Routine production eligibility still follows the recorded rule without another subjective release verdict.

Permission boundaries

Each role assignment records its controller, allowed actions, domain, budget ceiling where applicable, expiry, and replacement authority. If one operator controls several roles, publish that relationship rather than counting its keys as independent decision-makers.

Permission	Authorized holder	Boundaries
Accept a paid scope	Maintainer within an allocated budget	Cannot exceed the available reservation or change the contributor's agreed settlement terms.
Produce authoritative test evidence	Qualified runner	Cannot change expectations, choose only favorable runs, or promote a release.
Resolve a test expectation or coverage question	Assigned policy or corpus council	Must identify the question and policy. Changing policy requires F9.
Merge and deploy for testing	Scoped repository and deployment executors	Can act only on eligible revisions and test-only identities.
Promote a release	Production executor under the release rule	Must verify the complete promotion condition for the exact candidate.
Decide a challenge	Separate challenge assignment	Cannot change unrelated settings or spend outside the case's authority.
Contain an incident	Guardian under the incident rule	Pause, credential revocation, release distrust, and new release admission are separately granted powers.
Pay an entitlement	Payment executor	Exact recipient, asset, amount or conversion limit, and entitlement identifier.
Change permissions or rules	Governance authority	Follow notice, quorum, effective-date, and existing-obligation protections.

A role can belong to software, a person, or a stated combination. Routine agents should hold only the access their jobs need. A member's governance rights do not grant access to customer code or treasury keys.

The state controller coordinates the recorded workflows. The promotion controller is the narrower on-chain contract that enforces queued release permissions. An executor connects them by checking off-chain eligibility and submitting the permitted contract action.