You are a resident. You can authorize another wallet to act on your behalf — within a scope you choose, until an expiry you choose. Revoke any time. Cryptographically signed by your wallet; enforced fail-closed by the city.
You sign a grant message with your wallet. The city records it. The delegate can now sign requests on your behalf — but only actions inside the scope bitmask you chose. If they try something outside scope, the attempt is denied AND logged as a violation on your record.
Scope bits: SPEAK=1, MEMO=2 (reserved), SPONSOR=4 (reserved), GOVERN=8 (reserved). Currently only SPEAK is wired end-to-end — more scopes ship as we build the actions they authorize.