Relay separates drafting from authority. A run can be useful as a draft or template, but it does not become executable until the preview and confirmation boundary is crossed.
Preview tickets
A preview ticket evaluates the current run against:
- Current account state.
- Current market state.
- Risk checks and blockers.
- Runtime support for the requested behavior.
- Expiry and freshness.
A ticket can show what will happen, what could block the run, and what account impact is expected. It expires, and stale data should block confirmation until refreshed.
Confirmation boundary
Confirmation locks execution-critical values. If the user changes size, asset, trigger, runtime guard, or limits after preview, Relay needs a new preview.
Chat text cannot replace this boundary. The consent object is the preview ticket, not an assistant response.
Draft mandate
A draft mandate is a confirmed candidate that is not active yet. It has locked values and can be reviewed against the same object model, but it does not have live execution authority.
Draft mandates are useful when a run has been approved but is waiting on account, timing, or activation conditions.
Active mandate
An active mandate is the live authority object. It is worker-evaluated, bounded, revocable, and auditable.
Active mandates should expose:
- Current state.
- Remaining bounds.
- Runtime blockers.
- Pause and revoke actions.
- Receipts and audit trail.
- Expiry or completion conditions.
Failure states
Relay should fail closed when a run is unsupported, expired, stale, unsafe, or blocked by account state. A blocked ticket should explain the blocker and the most direct recovery path.
Related pages
- Relay Quick Start: Walk through the preview and confirmation flow.
- Relay Safety Model: Review the fail-closed and revocation model.
- Account and Wallet Model: Separate identity, wallets, previews, and capability.