A limit, stated plainly

What is authority drift when every individual agent check still passes?

The skill cannot see authority drift. It evaluates one proposed action at a time and keeps no state between them, so a sequence that is wrong only in aggregate is outside what it can detect. This page exists to say that clearly, because the question in its title is the one a mandate does not answer.

HANRIA is a coined name. No expansion, derivation, or translation is published or intended. A U.S. trademark application is pending; no registration or completed clearance is claimed.

What drift actually is

A permission system asks whether this credential may call this service. It does not ask whether this action, stacked on the last ten, is still the task that was delegated.

The sharp case is the one where nothing looks wrong on any single line. Every refund is inside the per-refund ceiling, and forty of them in an afternoon empty the float. Every file read is inside the permitted prefix, and reading all of them is the export nobody authorised. Each call passes. The sequence is outside the grant.

That is different from an agent reaching somewhere it was never granted — a partner endpoint outside the allowed prefixes, say. That is a single action outside the mandate, and the skill answers deny on it. Worth separating the two, because only the first is drift.

The same shape appears when a sub-agent inherits a parent grant, when a session lasts longer than the task, and when "be helpful" is treated as approval.

What a mandate does, and where it stops

A mandate states bounds that each proposed action is checked against: kinds, verbs, target prefixes, counterparties, a per-clause amount ceiling with a currency, an expiry after which every action is denied, and which kinds can never come back permit without a person.

Every one of those is a bound on one action. The ceiling is per clause, per request — it is not a budget, and nothing adds it up. There is no cumulative total, no window, no running balance. The evaluator does not read its own log.

So a mandate makes a single proposed action checkable against something written down. It does not make the stack visible. Detecting drift that appears only in the aggregate requires state across actions, which this evaluator does not keep.

What you get instead is a record. Each decision is appended to a hash-chained local log naming the clause it relied on, and a person can read that log afterwards and see the shape of what happened. That is human review after the fact, not detection during. It is also not evidence to a counterparty: there is no published record format and no independent verifier.

And none of it prevents anything. If the agent ignores deny, the operation still happens.

Entry

Use the free hosted check, which runs the evaluator and keeps no request content: MCP https://check.hanria.ai/v1/mcp or HTTP https://check.hanria.ai/v1/check. Schemas and examples: hanria.ai/developers.

Honest verdict

If every check passed and the outcome is still wrong, you do not have a permission bug. You have an authority problem.

Write the grant, and check each proposed action against it. Then have a person read the recorded decisions, because that is the only place the aggregate shows up today. The skill does not perform that review and does not prevent an action. A runtime could refuse only by holding the credentials exclusively. Do not pretend a skill is a runtime.