> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attesso.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorizations

> Understand decisions, reservations, and the single-use execution grant.

An authorization is the durable result of evaluating one proposed action against one mandate. Every structurally valid evaluation creates an authorization, including non-allow results.

<Warning>
  HTTP `200` or `201` is not permission to execute. Proceed only while `can_execute` is `true`.
</Warning>

## Decision and state

The decision records the evaluation result:

* `ALLOW`: every policy constraint matched and Attesso created a reservation
* `DENY`: the action or a present value did not match
* `INDETERMINATE`: required data was missing, incorrectly typed, or unsupported

The state records the authorization lifecycle:

| State           | Can execute?                 | Meaning                                                 |
| --------------- | ---------------------------- | ------------------------------------------------------- |
| `RESERVED`      | Only before `execute_before` | One bounded execution is held                           |
| `COMMITTED`     | No                           | The executor accepted the action                        |
| `CANCELLED`     | No                           | Execution cannot occur and the reservation was released |
| `EXPIRED`       | No                           | The execution deadline passed                           |
| `DENIED`        | No                           | The proposed action did not match                       |
| `INDETERMINATE` | No                           | Attesso could not safely reach an allow decision        |

`can_execute` is recomputed after deadline reconciliation. Treat it as the final execution gate.

## Reservation safety

An `ALLOW` decision and its `RESERVED` state are created atomically. A mandate can have at most one active reservation, so two concurrent eligible proposals cannot both obtain an execution grant.

Your external credential must not outlive Attesso's grant:

* Bound it to the action as tightly as your provider allows.
* Ensure it cannot act after `execute_before`.
* Disable it before cancelling an authorization.
* Commit only after the executor accepts the action, not when a credential is created.

## Terminal transitions

```mermaid theme={null}
stateDiagram-v2
  [*] --> RESERVED: ALLOW
  [*] --> DENIED: DENY
  [*] --> INDETERMINATE: INDETERMINATE
  RESERVED --> COMMITTED: executor accepted
  RESERVED --> CANCELLED: execution impossible
  RESERVED --> EXPIRED: deadline passed
```

<Card title="Complete an authorization" icon="git-branch" href="/guides/complete-an-authorization">
  Implement commit, cancellation, expiry, and retries without reopening authority.
</Card>