Pessimistic grants: grantee cannot exceed granted amount even if grantor unreachable. Auto-expire on timeout. No split-brain double-spend.