Consent online isn’t consent. It’s a timestamp. AI agents don’t understand consent. They inherit it. Old permissions look the same as valid ones. No context. No expiry. No boundary. So they act. And the system calls it authorised. The problem isn’t the agent. It’s the missing structure (of consent) https://paragraph.com/@garethfarry/consent-is-not-a-signature

Most digital systems feel complete. They can identify who is acting, verify what that actor holds, and determine what actions are permitted. And yet something still breaks. An action can pass every check and still be illegitimate. Because systems model authorisation, not authority. They can tell you whether an action may proceed, not whether it is justified. That distinction has always existed in law and institutions. We’ve simply failed to encode it into our systems. This is the gap. New writing >> https://paragraph.com/@garethfarry/you-can-pass-every-check-and-still-be-acting-illegitimately?referrer=0x86df6c44C599E58042475fa64760c4F13cA186C5

Even if identity is self-sovereign, authority is still relational. As is human action and transaction. And most systems don’t model it properly. They verify identity. They don’t verify capacity to act. That’s where things break. v0.1 of SILT Core → https://github.com/Sugarlicks/silt-identity-core/releases/tag/v0.1

Authentication confirms who you are. Authorisation defines access. But mandate defines the capacity in which you act. Most systems collapse the three. New piece: Identity Is Not a Credential https://paragraph.com/@garethfarry/identity-is-not-a-credential