stack/docs/fleet/concepts/role-authority-and-leases.md

Fleet Role Authority and Leases

Role content describes behavior; protected authority is immutable code metadata derived only from the canonical class.

Required workstream classes

code, review, validator, orchestrator, team-leader, enhancer, and interaction are required FCM classes. merge-gate is additionally protected because it remains the sole approve-to-land and merge authority.

Class	Authority	Boundary
merge-gate	Approve-to-land and merge	Sole merge authority.
validator	Issue independent validation evidence/certificate	Never approves landing or merges.
orchestrator	Orchestrate topology and issue bounded leases	Does not gain merge authority.
team-leader	Use explicitly leased capacity	Cannot issue leases or mutate roster, credentials, topology authority, or merge state.
interaction	Receive requests and report status	Cannot orchestrate, issue leases, mutate configuration, or merge.
code, review, enhancer, custom classes	No protected authority by default	Persona prose cannot grant protected powers.

A lease is capacity authorization from an orchestrator, not ownership. It must identify a bounded task or period and does not alter the leased agent's roster identity, role contract, credentials, authority, or persisted lifecycle. Expiry/revocation returns capacity; it does not rewrite the roster.

Semantic validation rejects protected class/tool-policy mismatch in either direction. An instance named Ultron with class: validator remains validation-only. An instance named Tess with class: interaction remains request/status-only. Renaming either instance changes no authority.

For resolver layering and safe customization, see role classes and customize roles.