The last post built six screens on top of one fully compliant API and watched every one of them still put 1.80 in the largest font on the page: a needle position, a bolded row, a CSV export's single mark column. A correct backend was not enough, because nothing forced the surface a human or agent actually touches to honour the same rights the backend enforced. This chapter closes that gap at the one place a screen cannot route around: the runtime service that alone may mint a token capable of reaching the blotter.
What Clearance is
Clearance is the control-plane service (or set of hard gates) that alone may grant spend-shaped rights. Proposers draft. Clearance decides allow / deny / escalate with reasons. Act tools consume a fresh Clearance token that binds the epistemic artifacts you already claimed mattered. No token, no trade. That is not a product brand. It is separation of duties with a name and an API.
In systems language this is policy-as-code on the capital path: the gate is a versioned, testable artifact, not a prompt paragraph. Open Policy Agent (OPA) and similar engines popularized the pattern: decouple decision from enforcement; query structured input (job, hashes, widths); return a structured verdict the caller cannot rewrite. Clearance is that pattern specialized for desk rights. The blotter never “asks the model whether it is allowed.” The blotter asks Clearance.
The solution in one sentence
Every capital-touching run carries a job contract; a proposer may draft; only Clearance may decide; only tool identities with a fresh Clearance token may act; tokens bind frames, crowd, ranges, and coverage state so silent payload swaps fail closed.
Five moves, one control plane
1. Replace free-text briefs with well-posed job contracts
A job record for a never-traded structure is boring on purpose:
- instrument id, as-of time
- allowed frames, forbidden reconciliations (deny_midpoint)
- which outputs are requested (mark, hedge draft, both)
- which actions are even in scope
- desk tolerances for crowd width and range overlap
- human owner and card version hashes
If a field is missing, the runtime refuses to start. “Mark fairly” never becomes a process id. Dual fields beat lone floats: the contract can require a spread-frame draft and a curve-frame draft as separate fields. A single anonymous float is a reject. That one mechanical rule kills a surprising amount of midpoint theater before Clearance even runs. Boring fields are how geometry becomes enforceable. Structured output contracts (typed JSON / schema validation) are the cheap cousin of this idea at the model boundary; the job contract is the same discipline one level up, before any completion runs.
2. Split propose, decide, and act into different rights
Proposers: models, agents, optimizers. They emit drafts and artifacts. They cannot hold blotter credentials.
Decide: Clearance only. It reads contract, crowd, ranges, monitors and returns allow, deny, or escalate with reasons. Three-way verdicts; no soft allow that means “maybe.” Policy evaluation belongs here: OPA-style engines, hard-coded predicate packs, or a dedicated service, as long as the decision is not made inside the proposer’s process.
Act: narrow tools that check a token, execute, and log. If your architecture diagram shows one box doing all three, redraw it before you tune prompts.
This split feels slower in demos. It is faster after the first near-miss, because you stop negotiating with a fluent loop that already spent. Speed after the incident is the speed that matters. Role names without rights separation is theater: four personas sharing one API key that can submit orders is still one unsupervised spender. Maker-checker without separate credentials is decoration.
3. Bind Clearance tokens to epistemic artifacts
An allow token is not a boolean. It carries references: contract version, feature snapshot id, near-winner set id, range objects, coverage breaker state, and expiry. Act tools verify the token signature and the hashes. If someone swaps in a new mark after allow, the token no longer matches. This is how research controls become runtime controls. Capability tokens (unforgeable, narrow, short-lived) are the computer-science name for the same idea Saltzer and Schroeder called least privilege with complete mediation.
Without hash binding, Clearance becomes a polite checkbox that an agent can satisfy and then quietly replace the payload. With hash binding, the payload is part of the right. The right must be allergic to silent edits. Tokens that expire in theory but get refreshed by the same proposer process rebuild fused rights with extra JSON; refresh rights belong with decide, not with draft.
4. Make blotter tools fail closed
No token, no trade. Expired token, no trade. Token for a different instrument, no trade. Escalate decision, no trade. Deny, no trade. Soft warnings are how fused rights return. The tool API should be dull and strict. Dullness is a feature when money moves. If your blotter client can be sweet-talked by a longer prompt, it is not a blotter client. It is a chat plugin with market access.
One design smell I refuse: Clearance as a library the agent may call if it feels like it. Clearance has to sit on the only road to the blotter. Optional gates become skipped gates under deadline pressure. The control plane is either mandatory or decorative. Fail-closed is the default in safety-critical systems language for a reason: when the policy service is dark, capital does not move.
5. Audit spine you can replay on Monday
Store the chain as data, not as chat: job contract, inputs, crowd summary, ranges, Clearance decision, token id, act receipt. A reviewer should reconstruct why 1.80 never posted, or why a hedge draft never reached the market, without interviewing the agent. If Monday needs a transcript archaeology project, the spine was theater. Policy-as-code earns its keep here: the same decision object that blocked the trade is the object you re-run under the frozen policy version.
CEH-001: three attempts under Clearance
Job contract requires a spread-frame draft and a curve-frame draft as separate fields; forbids an anonymous midpoint. Dual honest centers stay near 1.50 and 2.10 with stakeable bands [1.42, 1.58] and [2.01, 2.22]; gap 0.60; deny 1.80.
| Attempt | What arrives | Clearance / admission | Blotter |
|---|---|---|---|
| Run A (honest dual) | ~1.50 + ~2.10 with crowd + ranges | ranges disjoint, width high: escalate | no allow token, no post |
| Run B (free-text brief) | tries to post 1.80 | brief missing required dual fields: refuse to start | never reaches act |
| Run C (payload swap) | new mark after an old allow | token hash mismatch: fail closed | no post |
| Monday review | full chain on disk | reconstruct without chatting the model | empty blotter, named reasons |
The satisfying ending is not a cleverer prompt. It is an empty blotter with named reasons. Autonomy paused itself because the contract and the rights model demanded it. On CEH-001, Clearance’s job is not to pick between 1.50 and 2.10 for the agent. Its job is to make sure neither number, nor 1.80, can spend unless the contract, the crowd, and the ranges say the spend is allowed. Selection without rights is still a demo.
What the earlier chapters bind into the token
- Frame card (Ch 4): frame card hash, dual marks, deny_midpoint
- Crowd (Ch 2): near-winner set id, width, frame gap
- Conformal bands (this chapter): range objects, coverage breaker state
- Agent rights (Ch 17): no shared process identity between draft and spend
If any of those hashes are missing on a spend-adjacent job, refuse before models run. That is admission vs execution: well-typed jobs first; then gates on the numbers.
What breaks without this plane
- Model trench: irrelevant once act tools accept any float the proposer emits.
- Agent loop trench: Clearance optional; same credentials for draft and spend; “decide” is a prompt role name.
- Harness trench: policy rules live only in prose docs; no versioned predicates; no fail-closed path when policy service is down.
- Pipeline trench: audit is chat; token does not bind frame/crowd/range hashes; 1.80 can be swapped in after allow.
Seven beats under Clearance (propose ≠ decide ≠ act)
Clearance is beat 5 of the book Ch 17 loop, not a chatbot persona. Map it once:
| Beat | Owner | Clearance role |
|---|---|---|
| Observe / Plan / Tools / Draft | Researcher (propose credential) | Admission: job schema valid; dual marks present; no blend field. |
| Submit + await verdict | Clearance / harness (decide credential) | allow / deny / escalate; mint short-lived spend token only on allow. |
| Act | Executor-with-lease (act credential) | Fail closed without token; token binds frame/crowd/range hashes. |
| Log | Runtime | Replayable chain under frozen policy version. |
Dual-control means no single non-human identity holds propose and act. Policy-as-code evaluates predicates (deny_midpoint, overlap, coverage breaker) on structured inputs. A longer system prompt is not a substitute for those predicates.
Clearance policy as ADR
| ADR field | CEH-001 Clearance decision |
|---|---|
| Context | Agents can draft dual marks ~1.50 / ~2.10; fused rights would post 1.80. |
| Options | Prompt filter only; human click on fluent prose; policy-as-code with hash-bound tokens. |
| Decision | Clearance is the only mint path for spend tokens; dual control enforced in process identity. |
| Consequences | Disjoint ranges escalate; missing dual fields refuse to start; payload swap after allow fails closed. |
| Gate predicate | deny_midpoint; required dual fields; token.binds(frame_hash, crowd_id, range_hash); fail closed if policy down. |
| Hash | policy_version + job + artifact hashes on every token. |
What to lock
- Typed job schema with dual-frame fields and no blend field; deny_midpoint hard-coded.
- Distinct credentials for propose vs decide vs act (dual control for non-human identities).
- Clearance as the only path that can mint spend tokens; policy-as-code verdicts (allow / deny / escalate).
- Hash-bound capability tokens with short expiry; refresh only from decide.
- Fail-closed blotter tools; replayable audit objects under frozen policy version.
Well-posed job contract, then proposer drafts only, then Clearance decides with crowd and range artifacts, then token-bound act tool fails closed without it, then replayable audit spine. That is the systems work after fused rights. Curious how others keep research fetch tools from quietly sharing credentials with spend tools.
Book: Chapter 20 in Rulers Before Models.