# Policy and authority

> Separate orchestration intent from the local capability to create effects.

Source: https://accd.github.io/verchestra/docs/concepts/policy-and-authority/
Content digest: `sha256:5cff46e7c556e33345a83779019271da68ffe048fd56f5388335c066f027f0e7`

Policy answers whether an effect is allowed. Authority proves that this environment can perform it.

A driver proposes capabilities; the policy layer narrows them. Credentials and leases are resolved locally and expire independently from the Execution Package. Approval-sensitive effects require an explicit grant before execution.

This prevents a portable package from becoming a portable secret or a universal permission token. The same task may be executable on one machine and blocked on another while preserving identical requirements.