02 — The two documents and the delta
Summary
Two files, not one, because they differ on every axis that matters: the grant is generated by measurement and carries a measurement date; the mandate is authored by a person, signed by an issuer, and carries an interval without which it is a grant under another name. Neither gets a keypair — both are artefacts. The grant document carries provenance and a tier per node, keeps unevidenced nodes and marks them rather than dropping them, and carries a history field that changes the meaning of every node beneath it. The mandate stores an allow-list (the enforceable form) and renders prohibitions from its complement, dated, because that is what a person can accept. The delta is recomputed on demand and never persisted, for the same reason a register entry carries no history array: a stored delta is stale the instant either side moves.
Key concepts
- The grant document — measured, dated, provenance and tier per node, floor not census
- The mandate document — issuer-signed, interval-bearing, allow-list stored, prohibitions generated
- The delta, computed not stored — C7's rule applied: derived values are recomputed, never persisted
Key ideas
- A node evidenced by nothing is kept and marked, because the gaps are worth mapping too.
- A measurement date, not a version, because drift is answered by re-measuring and diffing.
- An allow-list that compiles to Cedar inherits evaluation outside the loop; one that compiles to a prompt does not.