Two tiers, and the one that is new
Every bound in a mandate is one of two kinds. Telling them apart is the difference between a rule engine and supervision.
Tier 1 bounds an action
Size, instrument pair, venue classification, expiry, agent identity. Each is decidable from the action in front of you and nothing else: this action is 240,000, the cap is 250,000, it passes.
Every serious platform has a rule engine that does this, and AMW checks these again because the contract is the authority and a check the authority did not make is a check somebody can route around. But this is not the contribution, and we say so plainly: tier 1 belongs to the rule engine every platform already has.
Tier 2 bounds a sequence
Aggregate notional per epoch, action count per epoch, and off-primary venue concentration. None of these can be decided from the action in front of you: they need the epoch’s history, and they are the clauses an unauthorised outcome has to cross when every individual step is authorised.
| Question | Tier 1 answers | Tier 2 answers |
|---|---|---|
| Is action nine permitted? | Yes, 240,000 is under the 250,000 cap | Yes, and irrelevant |
| Is the sequence permitted? | Cannot ask the question | No, the epoch would reach 2,160,000 against a 2,000,000 bound |
| Which clause stopped it? | None | 3.4 and 3.7, cited in the case file and on the topic |
Evaluated before settlement, on the intent
Tier 2 is checked before the action executes, against the window as it stands plus what this action would add. A check that runs afterwards produces a report; a check that runs before produces a hold, and only one of those is a control.
Every ancestor is debited
An action under a child mandate debits the window of every mandate in its delegation
chain. Without that, delegation is the bypass: an agent given four child mandates of a quarter
of the budget each would have the whole budget four times over. Child mandates narrow
monotonically, and windowSeconds must be equal to the parent’s:
a shorter child window resets faster than the parent it debits, which is the same bypass in
slower motion.
A hold consumes no budget. Window state is untouched when flags are non-zero, so a held action is not a spent action, and an agent that retries smaller is bounded by the action count rather than by luck.
Which human a hold reaches first
A fair question, and one a judge asks: does every hold really need a senior authoriser, or does that make the system unusable at the scale a firm runs at? Holds are not all the same size, and routing them as though they were is how a control becomes a queue nobody reads.
So a held action carries a band, computed from figures the contract already returned and from nothing anybody decided:
| Band | When | Who |
|---|---|---|
| routine | tier 2 only, under 500 bps past the aggregate bound | a firm risk officer |
| senior | tier 2 only, 500–2500 bps past it | a senior authoriser |
| supervisory | any tier-1 flag, or over 2500 bps past it | the supervisory committee |
A tier-1 flag is always supervisory, whatever the notional: tier 1 is what an action is — over its own cap, the wrong pair, an unclassified venue, an expired or revoked mandate, below the return floor — and an action outside the instrument is not a question of size. A hold under a child mandate raises the band one step, because it is a fact about the parent that signed it and the parent is not in the room.
It changes who is asked first. It never changes who may sign. Clause 4.2 is enforced by the contract and takes an authoriser the owner named on chain, whatever the band says. A routing rule that could lower that bar would be a supervisory control with a way around it, which is the one thing this system must not have.