Part III — Clearance, waivers, and grants

Three kinds of signed permission slip {#S7}

There are three separate permission slips, one for each kind of question. A clearance says "yes, this destructive step may run," and it must be recorded before the step runs. A waiver lifts a stop at one particular locked door. A grant widens where a helper is allowed to write across into another project. Each lives in its own logbook, and none of the three can override a full "stop" from the guard — a stop is always checked first and no slip is even consulted for it. All three are signed with the same shared secret pen and refuse to work if that pen is missing. The honest ceiling, plainly: a signed slip stops an outsider who doesn't hold the pen — it does not stop someone who does.

The permission logbook {#S8}

Every decision the guard makes is written as a row in a logbook. At a locked door the rows are read like this: a recorded "stop" anywhere blocks the way (checked first); a plain "pass" lets things through; a "pass-with-conditions" only lets things through once every listed condition has actually been confirmed done — until then it blocks exactly as if it were a stop; and a slip that has already been used is crossed off so it can't be replayed. A slip that grants permission has to come from an approved signer. There is also a look-only way to inspect the logbook that spends nothing and changes nothing.

The slip that lifts one specific lock {#S9}

A waiver clears one specific locked door — say, a particular destructive step, or the lock that refuses stale safety news — and it never lifts a full stop. To count as valid it must match the exact action it names, have its conditions confirmed, name a real approver from the approved list, still be within its expiry date, still have uses left, and carry a valid signature. Each time it is used, the count ticks up and the slip is re-signed, so quietly editing the counter breaks it; and with no signing pen it simply refuses. The logbook and the list of approvers are created the first time they're actually needed, so not finding them in a brand-new project is normal, not a fault.

The slip that widens where a helper may write {#S10}

A grant lets one project's team allow another team to write in one specific folder — the cross-project cousin of a waiver. It is signed, limited to that scope, and expires. The important plain fact: a grant only takes effect the next time the project is rebuilt — a freshly issued grant does nothing on its own, and there is no way for a running helper to widen its own locked room. The checks run in a strict, fail-safe order, and a project cannot simply clear itself. And like every slip, a grant widens a boundary but never overrides a full stop.