The Authority Object.
The smallest unit of human authority.
The web has the packet. Money has the transaction. Databases have the record. Blockchains have the block. The Human Operating System has this — one tiny, signed, bounded, revocable object. Everything else is an expression of it.
What every object must carry.
Eight fields, in one order, spoken the same way by a payment, a door, and a healthcare request: human → delegate → capability → scope → constraints → expiry → reversibility → proof.
Authority flows from a person. Always. There is no other origin.
A twin, an agent, an app, a device — never a person's private identity.
A single thing it may do. Not a role, not a login — one action.
A reference to the thing, never the thing itself.
How much value, how many times, how sensitive — the ceiling it can't cross.
Authority is never permanent. Every object dies.
Can the effect be undone? Irreversible acts demand the human.
An opaque commitment, written only when the object is exercised.
The half where the philosophy becomes engineering.
Just as important as the grammar is the forbidden set. An object that tries to carry the data, the key, or a blank cheque cannot form — the guard throws before it exists. “Memory is not permission” stops being a slogan and becomes a type.
instead → a reference to it — the object points at the labs, it never carries them
instead → a proof of a claim — “over 18”, never the birthday
instead → nothing — a recovery fragment is the self, and is never delegable
instead → a bounded scope — no “all”, no “*”, no standing power
instead → an expiry — authority that cannot end is not authority, it is capture
instead → silence — why a person decided is theirs, not the object's
One primitive. Five unrelated actions.
Pay an invoice, schedule a meeting, unlock a door, read a lab result, prove your age — the same object expresses each, and the guard on the right refuses the ones that would betray you.
Agent X may spend up to 25 EC on invoice 8842.
- human
- IRON-VECTOR-8842
- delegate
- agent-x
- capability
- send-value
- scope
- payment:invoice-8842
- constraints
- ≤ 25 EC
- expiry
- 1 h
- reversible
- yes
- proof
- — (written on exercise)
The guard runs before any object can exist. Try to smuggle in the data, the key, or a blank cheque — the primitive refuses to form. The philosophy is a type, not a promise.
Echo Pay isn't the architecture. This is.
The Twin, the Factory, the Exchange, Nearby — none of them invent their own permissions. They mint Authority Objects. Get the primitive right and dozens of things become expressions of one coherent system.
tries to keep other builders out. It rots the moment someone copies the surface.
makes other builders want to orbit the standard. Copying the website becomes irrelevant.
The test for everything we add: if someone copied this feature tomorrow, would Echo still possess something they don't? If the answer is only “our design,” it's weak. If it's the protocol, the accumulated authority history, the interoperable ecosystem, and the cryptographic guarantee — we're getting somewhere formidable.
Don't build a moat around Echo. Build gravity around its principles.
Honest edges
A new kind of leak we haven't named could still ride along. The set is versioned (AO-1) so it can grow — but it will never shrink.
The object never carries the data, but a careless scope ref can over-reach. Minimization lives one layer up, in the Kernel that fills the scope.
An object marks a door unlock irreversible, but the world enforces that, not the object. The primitive can only insist the human confirms.
Get the primitive wrong and everything above it inherits the weakness. Get it right and the whole system is just this object, exercised — a million times, always with a human at the source.