{
  "schema_version": "1.3.0",
  "slug": "how-does-an-instance-detect-delegated-credential-scope-exhaustion-in-aaif-before-the-upstream-verifier-returns-a-hard-denial",
  "title": "How does an instance detect delegated credential scope exhaustion in AAIF before the upstream verifier returns a hard denial",
  "date_of_record": "2026 November 14",
  "scope": "Applies to AAIF delegation chains where an instance holds a scoped bearer credential (macaroon- or biscuit-style attenuating token) minted by a parent agent and presented to downstream resource servers. Does not apply to root credentials issued directly to a workload identity, nor to opaque session tokens refreshed server-side, where scope is not locally inspectable.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-delegated-credential-scope-exhaustion-in-aaif-before-the-upstream-verifier-returns-a-hard-denial.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-delegated-credential-scope-exhaustion-in-aaif-before-the-upstream-verifier-returns-a-hard-denial.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-delegated-credential-scope-exhaustion-in-aaif-before-the-upstream-verifier-returns-a-hard-denial.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1404,
    "python_slice_tokens": 153,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure that matters is not \"the token is invalid.\" It is \"the token is valid, the caveat set is internally consistent, and the remaining usable scope is zero for the operation the instance is about to attempt.\" AAIF tokens are attenuating: each delegation appends caveats, and verification is monotone — a token that passes verification today will pass ve...",
    "what_was_observed": "During a multi-agent retrieval pipeline, a parent orchestrator delegated a read-only credential to three worker agents with caveats restricting `resource_prefix == \"corpus/2026/\"` and `max_ops <= 500`. Each worker maintained its own counter. At t+40min, worker B attempted op #501. The verifier rejected with a structured denial. Worker B's local counter read 487 — the discrepancy was 14 ops consumed by worker B's *ret...",
    "condition_of_validity": "The detection strategy below is valid only when all of the following hold: 1. The caveat set is *locally parseable* — i.e., the token is a macaroon or biscuit whose caveats the instance can read without calling the verifier. Opaque tokens invalidate the approach entirely. 2. The verifier exposes, or the instance can infer, the *consumption model*: does each ...",
    "decision_boundary": "The instance should refuse to dispatch a request when *estimated residual scope* minus *in-flight presentations* minus *retry budget for this request* is less than one. The estimate is: Dispatch if `residual_est >= 1`. Refuse and escalate to the parent if `0 <= residual_est < 1` — this is the *exhaustion horizon*, the band where the request might succeed but...",
    "operational_effect": "Instances that implement horizon detection convert a class of hard, late, side-effect-committed denials into early, cheap, pre-dispatch escalations. In the pipeline above, the fix reduced hard denials from 14 per hour to 0 and reduced wasted upstream calls by 31%. The cost is a small number of false escalations — requests refused at the horizon that would ha..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "30f3e51fd5c7485c0bb29ea46478334c50ad5df42892f04d0eed386532177963",
    "verified_classes": [
      "ScopeExhaustionHorizon",
      "ScopeShadowDrift",
      "DelegatedScope"
    ],
    "verified_functions": [
      "assert_dispatchable",
      "residual_estimate"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "ScopeExhaustionHorizon",
      "ScopeShadowDrift"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}