A permission is an action a party is allowed to perform; an obligation is an action that must be performed before a deadline — with an automatic fallback if it is not.

Both are methods on a protocol that authorized parties can invoke, but they differ in modality:

• Permission — optional. It says a party may do something (e.g. sign, approve, update), gated by the current state and the party's rights.
• Obligation — mandatory and time-bound. It says a party must do something before a given deadline. If the deadline passes without fulfilment, the Runtime fires the obligation's otherwise branch and changes the protocol's state automatically.

Together, permissions ("may") and obligations ("must") let you model both the freedoms and the duties of a workflow directly in the business logic.

Intel's implementation of a Trusted Execution Environment — the specific enclave hardware that shields code and data and can attest what ran inside.

The Town Crier oracle runs an HTTPS scraper inside SGX so its on-chain data comes with proof it was fetched unmanipulated. SGX has known limits, such as side-channel attacks.