Dual-key authority is a simple promise with a strict implementation: no state change that matters happens without two independent acts — the machine proposes, the owner disposes.

The machine half:

The agent does the work: drafts, enriches, routes, proposes. It can do everything except the one thing reserved for the owner. Its output lands in a holding state — draft — that is invisible to the public and inert to the system.

The owner half:

The owner reviews and flips. That flip is the second key. It is deliberate, recorded, and irreversible-feeling: the reverse of publish is archive, never a silent undo.

Why two keys and not one:

One key is a password. Two keys is a governance structure: the party that produces the work is structurally separated from the party that authorizes it. Neither can ship alone. That separation is the whole point.