Definition

An authorization object is an explicit machine state that grants a specific action under defined scope and time, and can be revoked independently of execution.

It is not execution. It is not identity. It is not access.

Properties

• Explicit: it exists as data, not implication.
• Scoped: it authorizes a particular action, not a general capability.
• Time-bounded: validity is a field, not a scheduler assumption.
• Revocable: authority can be withdrawn without “undoing” execution.
• Independent: authority and execution are separate layers.

Live proof

Interdict demonstrates the separation directly:

Time reaches zero → execution is attempted → authority decides the outcome.