Live entitlement means an agent's access is resolved from the current subscription on every request, rather than frozen into the credential the day it was issued. The same token keeps working through a renewal or an upgrade, and stops when the subscription does.
Why it matters
Access baked in at issue time drifts away from the truth. A key minted during a trial keeps its trial reach after the customer upgrades, and a lapsed account can keep reading for as long as an old credential says it may.
The usual patch is to re-mint. That means finding every agent, script, and config holding the old secret and updating each one, which is exactly the chore nobody finishes on the day it matters.
Resolving at request time removes the chore entirely. The credential says who is calling; the live account says what they get.
How Jinn treats it
A Jinn token carries no frozen tier. Its access resolves from the live subscription on every request, so a trial converting to paid, a renewal, or an upgrade all take effect on the very next call with nothing to re-mint and nothing to reconfigure.
When a subscription lapses, the expiry error carries a renewal link scoped to the brand, and renewing rolls the expiry forward so the same bearer resumes working. If entitlement cannot be read at all, the call is refused rather than assumed.
The tier model, the expiry error, and the renewal path are documented publicly. See it
Related terms
The account decides, not the credential.
Access is read fresh on every call, so upgrades and renewals need no new secret. Read how the auth model resolves it.