Identity
Who is acting, approving, receiving, and operating the route.
Module 05 · Authority and Binding
Permission is not enough. It must bind to the route.
Authority can be genuine and evidence can be admissible while the proposed execution is still wrong. Binding connects every approved element to the exact actor, object, beneficiary, destination, environment, and consequence that may proceed.
No exact binding. No legitimate transfer of authority into execution.
HOLD2 unresolved bindings
The binding surface
Six things must correspond.
A route is not one field. It is a bounded relationship. Changing one consequential dimension can create a different route—even when every other field remains unchanged.
Authority
Which source grants power, under what scope, threshold, and time boundary.
Object
The exact payload, request, invoice, instruction, model action, or intervention.
Destination
Where value, data, authority, or physical consequence will be delivered.
Environment
The tool, model, tenant, system state, location, and runtime context.
Consequence
The specific result the route is permitted to create—and no broader result.
Interactive lab
Find the substitution risk.
This payment route passed evidence review. Inspect each binding before consequence. Correcting a mismatch creates a valid route state; it does not make the original mismatch disappear from history.
Selected binding
Destination
The proposed destination does not match the independently verified supplier account.
Proposed route valueAccount ending 8841
Verified bounded valueAccount ending 2916
Substitution detected. The proposed value differs from the verified route value and cannot inherit its authority.
Authority + Evidence
without Exact Binding
≠ Admissible Execution
without Exact Binding
≠ Admissible Execution
The governing distinction
Authority does not float.
An approval is not a transferable token that can be attached to any later action. It is valid only for the bounded conditions under which it was granted.
- A verified supplier does not validate an unverified bank account.
- An approved amount does not authorize a larger payload.
- An authorized operator does not authorize an unapproved model or tool.
- A permitted purpose does not authorize a different beneficiary or destination.
- A valid route cannot be silently widened after review.
Knowledge check
Can you preserve route identity?
Choose one answer for each question, then score the lesson.
1. What does binding prevent?
2. The supplier is verified, but the payment account differs from the verified destination. What should happen?
3. Why must the execution environment be bound?
Lesson result
Complete all three questionsContinue the route
Next: Commit and version history.
Once the route is exactly bound, TA-14 must preserve what was approved so that the execution object cannot be replaced, expanded, or redirected after authorization.