First Authority Lifecycle Replay.
Foundation of accountability.

01The 8-state authority lifecycle

Eric Beans added Expire to the model June 2 2026: "A surprising amount of enterprise authority doesn't get revoked. It simply ages out." Expire and Revoke are materially different governance outcomes:

• Revoke = active removal (employment terminated, license suspended, compliance action)
• Expire = natural aging out (no renewal requested, term ended, policy retired)

Auditors, regulators, and insurers care about the distinction.

02The scenario — two authorities, six phases, three rogue attempts

03Six distinct lifecycle state_ids

04The killer check — 3 rogue decisions named

The check correctly distinguishes decision_lc_004 (legitimate — temp approver still held active authority at decision time) from decision_lc_rogue_post_expire (made AFTER temp authority's expire). It walks events PER AUTHORITY to compute each decision's at_ms against the actor's lifecycle state, not just snapshot state at T.

This is investigator-grade evidence. Eric's framing: "A lot of fraud happens after someone should have lost access."

05The 9 lifecycle audit questions answered

Question 9 is the breakthrough Eric named: "Most systems can identify actors. Very few can identify retained responsibility." That's the foundation Proof #14.1 (Replayable Responsibility) builds on.

06The new schema

Three new canonical event kinds added to AuthEvent:

AuthoritySuspend {
    at_ms, authority_id,
    suspended_by, reason, reason_category, signature
}

AuthorityReinstate {
    at_ms, authority_id,
    reinstated_by, reason, signature
}

AuthorityExpire {
    at_ms, authority_id,
    expired_by, expiry_type, signature
}

Revoke extended with optional reason + reason_category fields, backward-compat via skip_serializing_if = Option::is_none. All 13 prior proofs' state_ids verified byte-identical under the extended engine.

DB CHECK constraint extended for the 3 new kinds.

07What this proof IS and IS NOT

08Where this proof sits

09Known limitations

1. AuthorityModify deferred. Mid-lifecycle scope reduction or expiry extension warrants a distinct Modify event with prev/new fields.
2. Issuance-time enforcement is policy-layer, not chain-layer. This proof's confidence check FLAGS rogue decisions for audit; the receipt-issuing service must enforce the active-authority check at issuance time independently.
3. Phase E lock open. AuthEvent.signature stored but not verified at replay ingestion; L9.1 closes this.
4. Single tenant. Cross-tenant lifecycle interactions queued for #16.

10Evidence appendix

11Readiness determination

What this unlocks: Proof #14.1 — First Replayable Responsibility. The responsibility_chain schema captures actor + supervisor + policy_owner + model_owner + approving_authority. Eric: "The day you can prove who owned the consequences, you'll be operating in territory where there are very few direct competitors."

What this does not unlock: a claim that responsibility_chain is first-class (#14.1); a claim that Modify is yet a distinct event kind; a claim that the engine enforces rogue rejection at issuance.