Reference

Scope catalogue

21 scopes, 3 of them critical. Identifiers are stable and additive — we never repurpose one, and a deprecated scope keeps evaluating to deny forever rather than becoming something new.

Risk tiers and affirmation ceilings

A scope’s tier is not a label, it selects the enforcement profile. This table is the complete mapping.

Tier	Affirmation max age	Required factors	Window ceiling
low	90 days	written	no ceiling
medium	7 days	written	≤ 8 h
high	60 minutes	written + verbal	≤ 4 h
critical	one window	written + verbal + capacity	≤ 90 min

Negotiation3 scopes

`negotiation.read`Read negotiation historylow	Enumerate prior policies with the same counterparty, including everything that was declined.eligible: top · bottom · switch · monitor
`negotiation.propose`Propose a scope setlow	Draft a policy for another subject. A proposal grants nothing; it only starts a workflow.eligible: top · bottom · switch · vanilla
`negotiation.amend`Amend an active policyhighstep-up	Widen scope mid-window. Amendments never apply to the session in progress — they queue for the next one.eligible: top · bottom · switch

Scene4 scopes

`scene.open`Open a sessionmediumstep-up	Mint a time-boxed session token from a signed policy. Fails closed if any required affirmation is stale.eligible: top · bottom · switch
`scene.extend`Extend a session windowhighstep-up	Push a token's expiry. Capped at one extension per window, and only while the original is still valid.eligible: top · bottom · switch
`scene.close`Close a sessionlow	End the window and open the aftercare SLA. Any party holding scene.open may call this; nobody needs permission.eligible: top · bottom · switch · monitor
`monitor.hold`Hold a monitor positionhigh	Stand watch over a session you are not a party to, with emergency write authority and zero negotiating authority.eligible: monitor · switch

Power exchange3 scopes

`power.exchange`Exchange authoritycriticalstep-up	Transfer decision authority for the duration of a window. Bounded, revocable, and never transitive.eligible: top · bottom · switch
`power.hold`Hold delegated authoritycriticalstep-upself only	Act on another subject's behalf within a granted envelope. Cannot be delegated onward — no sub-grants, ever.eligible: top · switch
`power.return`Return authoritylowself only	Give the delegated scope back early. Always available, never declined, never logged with a reason field.eligible: top · bottom · switch

Contact3 scopes

`contact.impact`Impact contacthighstep-up	Striking within agreed implement and body-region allow lists. Denied outright outside an active window.eligible: top · switch
`contact.restraint`Restraintcriticalstep-up	Restricting another subject's movement. Requires a monitor hold, a release plan, and a non-zero escape budget.eligible: top · switch
`contact.sensation`Sensation playmediumstep-up	Temperature, texture and intensity variation inside declared thresholds.eligible: top · bottom · switch

Limits2 scopes

`limits.declare`Declare a limitlowself only	Install an explicit deny. Callable by any subject at any time, including mid-scene, with no counterparty sign-off.eligible: top · bottom · switch · monitor · observer · vanilla
`limits.soft.amend`Amend a soft limithighstep-upself only	Move a soft limit after a cooling-off period. Hard limits are structurally absent from this endpoint.eligible: top · bottom · switch

Safeword2 scopes

`safeword.trigger`Trigger the safewordlowself only	Global session revocation. Free to call, unthrottled, un-auditable beyond the fact that it happened.eligible: top · bottom · switch · monitor · observer · vanilla
`safeword.acknowledge`Acknowledge a safewordmedium	Confirm you heard it and stopped. Acknowledgement is not consent to resume — resumption is a new negotiation.eligible: top · bottom · switch · monitor

Aftercare2 scopes

`aftercare.request`Request aftercarelowself only	Open a support window without needing a session to have occurred first.eligible: top · bottom · switch · monitor · observer · vanilla
`aftercare.provide`Provide aftercarelow	Bound by the response SLA in your plan. Unfulfilled aftercare is an availability incident, not a soft skill.eligible: top · bottom · switch · monitor

Audit2 scopes

`audit.read`Read the audit logmediumself only	Your own events, in full. Counterparty events are redacted to the fields you both agreed to expose.eligible: top · bottom · switch · monitor
`audit.export`Export audit historyhighstep-upself only	Machine-readable history, watermarked to the exporting subject. Re-sharing is detectable and attributable.eligible: top · switch · monitor

Reserved and unrepresentable

The following identifiers are rejected at parse time. They are listed here so you can see the shape of the boundary rather than guess at it.

rejected at parse

consent:prepaid          consent cannot be collected before a window exists
consent:inherited        a grant never passes to another subject
power:delegation.depth=2 no sub-granting; power.hold is terminal
revocation:conditional   withdrawal cannot depend on a counterparty
revocation:reason        the field does not exist in the schema
scope:*                  wildcards are deny-only
role:owner               there is no account that outranks a subject

Role eligibility

Role	Scopes eligible	Critical scopes	Posture
`top`	20 / 21	3	Holds scope — Critical ceiling
`bottom`	16 / 21	1	Grants scope — Critical ceiling
`switch`	21 / 21	3	Assumes scope — Critical ceiling
`monitor`	10 / 21	0	Audits scope — High ceiling
`observer`	3 / 21	0	Read-only — Low ceiling
`vanilla`	4 / 21	0	No scope — Low ceiling