DRAFT — schema definition only; this page issues no grant or revocation. See authority design notes.

DRAFT immutable signed irrevocable admin grant. Only irrevocable-admin ancestry may support an admin delegation; admin grants and admin ancestry cannot be revoked. Requires semantic validation.

This authority statement extends the existing signed Blob envelope directly. Placement and integration with mutable nodes remain separate, open design questions.

{
  "type": "hm://hyper.media/blob",
  "properties": {
    "type": {
      "value": "HM26Capability",
      "required": true,
      "description": "Provisional stored capability dispatch tag; not registered by the shipped daemon."
    },
    "delegate": {
      "value": {
        "type": "hm://hyper.media/principal"
      },
      "required": true,
      "description": "Single receiving key, provisionally; multiple-recipient grants remain open."
    },
    "subject": {
      "value": {
        "type": "hm://hyper.media/cid"
      },
      "required": true,
      "description": "Provisional authority subject: stable resource identity CID. Root/document/subtree scope and attenuation remain open."
    },
    "role": {
      "value": "irrevocable-admin",
      "required": true,
      "description": "Exactly irrevocable-admin for the permanent variant; reader or writer for the revocable variant."
    },
    "proof": {
      "value": {
        "type": "hm://hyper.media/link",
        "target": "hm://z6MkiAKDcRSzQ4zPZfnJcS5HYx5MwgN6MU9foHihJGrhqNBj/hm26/capability-admin"
      },
      "required": false,
      "description": "Optional exact immutable granting capability CID. Omission requires separately established root authority; it never proves authority by itself. Link target checking is advisory."
    }
  },
  "description": "DRAFT immutable signed irrevocable admin grant. Only irrevocable-admin ancestry may support an admin delegation; admin grants and admin ancestry cannot be revoked. Requires semantic validation."
}