The refusal path

The most important thing it does is say no

An agent that cannot refuse is just automation with a confidence problem. The same merge request, with and without authority. Concept

● Without a grant

The target refuses. The attempt, the refusal, and the reason are recorded — the failure is evidence, not a log line.

agent.act --merge PR-481 --repo app
# no grant presented
✗ REFUSED · target: missing authority
  receipt R-2291 sealed (refusal recorded)

● With a single-use grant

Same action, explicit authority: purpose-bound, limited to one repo, fifteen minutes, used once. The outcome is verified before the receipt seals.

agent.act --merge PR-481 --grant GR-1042
# purpose release-hotfix · 1 repo · 15m · once
✓ MERGED · outcome verified at target
  receipt R-2292 sealed (grant consumed)

Talk to it

One contract, any channel

The agent speaks the same grant-first contract whether you drive it from a terminal, a chat tool, or the platform API on graphnative.io. Concept

Ask for work

Describe the outcome. The agent drafts the action and requests the grant it needs.

agent.ask "close out invoice 1187"
→ needs: payment.issue
  limit: $2,500 · vendor V-88 · once

Grant the authority

A principal issues the grant. Narrow is the default; broad is the exception.

grant.issue --to pay-agent \
  --purpose invoice-close \
  --limit $2,500 --single-use

Read the receipt

Every run ends in a sealed receipt: grant, execution, evidence, outcome.

receipt.get R-2292
outcome: true
verified against settlement feed