# Window

A **Window** (REQ-015) is the primitive a Nomad uses to delegate a
capability without delegating custody. It is scoped, time-limited,
rate-limited, audited, and revocable. A Nomad opens a Window so a partner
or a service can act on the Nomad's [Stash](stash.md) within bounds the
Nomad set — the partner never gets custody, and the Nomad can close the
Window at any time.

## The five parts of a Window

| Part | What it bounds |
|---|---|
| **Scope** | what the grantee can do (e.g., read Stash balance, spend up to N Grain on a specific service). |
| **Duration** | when the Window starts and ends (a start time and an end time). |
| **Rate limit** | how many actions per duration window (e.g., at most 10 reads per hour). |
| **Audit log** | an append-only log of every action the grantee took under the Window. |
| **Revoke** | the Nomad can revoke the Window at any time; revoke after expiry is a no-op. |

## Why a Nomad opens one

A Nomad opens a Window for the same reason a Nomad uses [Maps & Pay](maps-pay.md):
to let a service do something on the Nomad's behalf without handing over
the Stash. Common examples:

- A recurring service (e.g., a Care service) pulls a capped amount of
  Bread from the Stash each week, within a rate limit the Nomad set.
- A partner reads the Stash balance for a compliance check, scoped to
  read-only, time-limited to one hour.
- A Stand operator processes a Pass-Act on the Nomad's behalf inside a
  scoped, audited Window.

## Lifecycle

A Window moves through a fixed lifecycle: **Open → Active → Revoked** or
**Expired**. A Nomad can revoke at any point; revoking after expiry is a
no-op (idempotent). The lifecycle is mission-locked: a partner cannot
extend a Window past its end time — the Nomad must open a new one.

## Self-service, by design

The Window is the self-service principle in code. The protocol records
the Window on OY Chain; the partner holds only the capability, never the
value. See [Six Principles](../shared/six-principles.md) for the covenant,
and [Pacts](pacts.md) for the contract shapes delivered through Windows.