What this is not

What is authority drift when every individual agent check still passes?

This is not a claim that HANRIA stops drift. The skill can flag a proposed action that falls outside a written mandate. It cannot prevent the action. The runtime that could refuse is not released.

HANRIA is a coined name. No expansion, derivation, or translation is published or intended. A U.S. trademark application is pending; no registration or completed clearance is claimed.

Why permission systems miss it

A permission system asks whether this credential may call this service. It does not ask whether this action, stacked on the last ten, is still the task that was delegated.

An agent scoped to read tickets later gains a connector that can notify a partner. Each call is fine. Nobody signed the wider scope. That is drift, not a single obvious crime.

The same shape appears when a sub-agent inherits a parent grant, when a session lasts longer than the task, and when "be helpful" is treated as approval.

What a mandate changes

A mandate states the shape of the whole delegation: kinds, verbs, targets, counterparties, amount ceilings, expiry, and which kinds always need a person. Checking each proposed action against that document makes the aggregate reviewable.

It does not make the aggregate enforced. If the agent ignores deny, the operation still happens.

Entry

npx skills add HANRIA-AI/hanria-skill

Honest verdict

If every check passed and the outcome is still wrong, you do not have a permission bug. You have an authority problem. Write the grant. Check the action. Do not pretend a skill is a runtime.