Your organization issues it. KIFF checks it.
Your organizationIssues the card.Actions, valid states, conditions, and the ceiling. The owner changes or revokes it; the agent cannot.
KIFFChecks every proposal.Allow, hold for a person, or refuse, using current state and the card.
Your systemRuns what's allowed.Your code keeps the execution path. KIFF never moves anything itself.
A card narrows what your domain and permissions already allow. It cannot make a forbidden action legal.