A grant is a typed, signed envelope describing what may run, where, for how long, with which tools. It’s the only source of dispatch authority in Flocks.
  • Signed by the gateway’s Ed25519 key.
  • Scoped to one driver, one roost, one TTL.
  • Audited — issuance and consumption both append to the chain.
Without a grant, no agent runs. Without a matching tool capability, no tool fires. Denied by default.