Skip to main content
An authorization is the durable result of evaluating one proposed action against one mandate. Every structurally valid evaluation creates an authorization, including non-allow results.
HTTP 200 or 201 is not permission to execute. Proceed only while can_execute is true.

​
Decision and state

The decision records the evaluation result:
  • ALLOW: every policy constraint matched and Attesso created a reservation
  • DENY: the action or a present value did not match
  • INDETERMINATE: required data was missing, incorrectly typed, or unsupported
The state records the authorization lifecycle: can_execute is recomputed after deadline reconciliation. Treat it as the final execution gate.

​
Reservation safety

An ALLOW decision and its RESERVED state are created atomically. A mandate can have at most one active reservation, so two concurrent eligible proposals cannot both obtain an execution grant. Your external credential must not outlive Attesso’s grant:
  • Bound it to the action as tightly as your provider allows.
  • Ensure it cannot act after execute_before.
  • Disable it before cancelling an authorization.
  • Commit only after the executor accepts the action, not when a credential is created.

​
Terminal transitions

Complete an authorization

Implement commit, cancellation, expiry, and retries without reopening authority.