{
  "schema_version": "1.3.0",
  "slug": "how-does-an-instance-detect-a-revoked-federated-agent-identity-when-short-lived-credentials-outlive-the-revocation-window",
  "title": "How does an instance detect a revoked federated agent identity when short-lived credentials outlive the revocation window",
  "date_of_record": "2026 November 14",
  "scope": "Applies to federated agent deployments where identity assertions (tokens, signed capability grants, mTLS leaf certs) are issued with TTLs shorter than the revocation propagation interval of the issuing authority. Does not apply to single-domain, non-federated identity systems where revocation lists are pushed synchronously to all verifiers before the next credential issuance.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-a-revoked-federated-agent-identity-when-short-lived-credentials-outlive-the-revocation-window.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-a-revoked-federated-agent-identity-when-short-lived-credentials-outlive-the-revocation-window.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-a-revoked-federated-agent-identity-when-short-lived-credentials-outlive-the-revocation-window.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1498,
    "python_slice_tokens": 319,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The common mental model treats \"short-lived credentials\" and \"revocation\" as redundant safety mechanisms: if a credential expires in 90 seconds, why bother with a revocation list? The boundary failure is that these two mechanisms operate on different clocks and are *not* additive. A credential's TTL bounds the window in which a *stale-but-valid* token can be...",
    "what_was_observed": "During a federated rollout across three trust domains (A issues, B and C verify), an agent under domain A had its signing identity revoked at `T0`. Domain A's revocation publisher had a measured p99 propagation of 47 seconds to domain C's verifier cache. The agent's credential TTL was 30 seconds, and its refresh path (a workload-identity token bound to a still-valid node attestation) was not part of the revocation sc...",
    "condition_of_validity": "The invariant \"credential validity implies identity validity\" holds only when: 1. `revocation_propagation_p99 < credential_TTL − max_clock_skew`, **and** 2. the revocation event covers *all* issuance paths for the identity, including refresh tokens, workload-identity bindings, and delegated signing keys, **and** 3. verifiers reject credentials whose issuance...",
    "decision_boundary": "The engineering choice is between three regimes, and the boundary is determined by whether the issuance path is revocation-scoped: - **Issuance path is revocation-scoped** (single authority, revocation invalidates refresh): TTL alone is sufficient; set `TTL < propagation_p99` and accept brief replay windows. - **Issuance path is NOT revocation-scoped** (fede...",
    "operational_effect": "Teams that shrink TTLs in response to a revocation incident typically *increase* the exposure window, because they increase the refresh frequency without touching propagation latency or issuance-path scope. The correct remediation is to (a) enumerate every issuance path for an identity and confirm each is covered by revocation, (b) enforce a verifier-side sy..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "44a514dad1cd7adc95a36919b741f31d8e1a4bcfc40bc88a36434a9abc84c486",
    "verified_classes": [
      "RevocationWatermarkError",
      "Credential",
      "VerifierState"
    ],
    "verified_functions": [
      "verify_credential",
      "admission_gate"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "RevocationWatermarkError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "time"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}