{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-refuse-capability-attestation-renewal-when-trust-broker-delegation-chains-cross-organizational-policy-epochs",
  "title": "In what scenarios must an instance refuse capability attestation renewal when trust broker delegation chains cross organizational policy epochs",
  "date_of_record": "2026 November 14",
  "scope": "Applies to federated multi-agent systems where capability attestations are issued by a trust broker on behalf of a delegating organization, and where each organization advances its policy epoch (a monotonically increasing version of its authorization rules) independently. Does not apply to single-org deployments, to flat trust models without brokering, or to attestations whose validity window is entirely contained within a single policy epoch of every party in the delegation chain.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-capability-attestation-renewal-when-trust-broker-delegation-chains-cross-organizational-policy-epochs.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-capability-attestation-renewal-when-trust-broker-delegation-chains-cross-organizational-policy-epochs.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-capability-attestation-renewal-when-trust-broker-delegation-chains-cross-organizational-policy-epochs.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 2092,
    "python_slice_tokens": 302,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious boundary is between *attestation validity* and *attestation admissibility*. A capability attestation can be cryptographically valid — signed by the right broker, unexpired, correctly chained, with a non-revoked subject — and still be inadmissible at the relying party because one link in the delegation chain was evaluated under a policy epoch ...",
    "what_was_observed": "During a cross-org federation between three parties — an orchestrator org (O), a brokering org (B), and a resource-holding org (R) — a renewal request for a `data:read` capability was accepted by B on behalf of O and forwarded to R. The chain was O→B→R, with B acting as broker. The original attestation was minted at O-epoch 41, B-epoch 17, R-epoch 9. Between mint and renewal, O advanced to epoch 42. The epoch-42 chan...",
    "condition_of_validity": "The invariant that must hold for a renewal to be safe is: > For every link `(org_i → org_{i+1})` in the delegation chain, the relying party must be able to evaluate the delegated capability under `org_i`'s *current* epoch, and the result must be a superset of (or equal to) the capability being renewed. This invariant is checkable only if the broker carries, ...",
    "decision_boundary": "The boundary is drawn at the point where the broker cannot produce a policy epoch vector and the relying party cannot resolve the delegator's current epoch within the renewal's latency budget. - **Below the boundary** (vector present, all delegator epochs resolvable, capability diff is a no-op or widening): renew with a fresh expiry, preserving the chain, an...",
    "operational_effect": "Implementing this boundary converts a class of silent authorization violations into a class of explicit renegotiation events. In the three-org deployment above, after the fix, renewals that crossed a narrowing epoch change produced a `RenegotiationRequired` signal within the broker's request path, the subject agent re-negotiated under O-epoch 42, and receive..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "880e9767bf4517ed7cdba00f9aba69908d9f8fe07acb4613242cf55fa1c62175",
    "verified_classes": [
      "StaleEpochRenewalError",
      "Attestation"
    ],
    "verified_functions": [
      "renew_attestation"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "StaleEpochRenewalError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}