Applications
Different decisions depend on different things.
Authorization rarely happens in isolation.
A network may need to decide whether to admit a device while the systems that established the relationship are somewhere else.
One organization may need to act on something established by another without handing over responsibility for its own decision.
An agent may need to act for a person without inheriting everything associated with that person.
These are different situations, and they expose different questions. What they share is one architectural model: the receiving system evaluates established authority where it makes the decision.
What that changes depends on the decision.
Connected Aircraft
Which decisions actually need the ground to participate when they are made?
An aircraft can be fully connected without every onboard decision needing a live round trip to ground infrastructure. Take network admission. Before boarding, an airline establishes the relationship, authority and conditions that decision relies on. The aircraft network still owns the admission decision.
On a bench, Krutho has shown that decision made against what was established beforehand, with the issuer absent from the join path.
The architecture is designed to keep the ground authoritative without it participating synchronously every time the aircraft makes that decision.
Connectivity can remain available without remaining a dependency of every decision.
Partner Access
One organization can establish something another relies on without making the decision for them.
Organizations routinely depend on relationships, facts and authority established elsewhere. That does not mean the organization that established them should make every resulting decision.
A receiving organization can determine what it trusts, what evidence it requires and whether what has been established elsewhere is sufficient for the decision it owns.
The relationship remains. The responsibilities remain separate.
Authority can cross a boundary without decision responsibility crossing with it.
Agent Delegation
Who is acting, on whose behalf, and under what authority?
When software acts for a person, knowing who is responsible and knowing what the software is authorized to do are different questions.
An agent can hold its own key while receiving authority bounded to a particular action and scope. The person can remain accountable without the agent becoming that person or inheriting everything they are authorized to do.
And carrying valid authority does not remove the receiving system's responsibility for deciding whether that authority is sufficient for the action being requested.
The person remains accountable. The agent receives bounded authority. The receiving domain still decides.
One architecture. Different decisions.
In each situation, something has already been established. A relationship. Authority. Relevant facts. Trust.
The immediate question is not where that information lives. It is: What is enough to make this decision here, now?
One decision requires another system to participate synchronously. For another, established authority, available state and the receiving domain's own requirements are enough.
Krutho is built to change which systems must participate when a decision is made, without changing who is responsible for it.