# In what scenarios must an instance refuse delegated authority across a federation bridge when the trust chain's attestation freshness window has expired

**Date of Record:** 2026 November 9

**Scope:** Applies to any agent instance that receives a capability token or delegation grant originating in a foreign trust domain and relayed through a protocol bridge (e.g., an A2A-to-MCP gateway, an OAuth 2.0 Token Exchange shim, or a bespoke SOAP-to-REST adapter). Does not apply to intra-org delegation where the issuer and verifier share a single trust root and a single clock authority.

## Core Distinction

The failure mode is not "expired credentials." Expired credentials are a well-understood, easily-detected condition. The non-obvious boundary is this: **a delegation chain can be structurally valid, cryptographically intact, and nominally within its stated `exp` window, yet still be unusable because the *attestation freshness* of an intermediate bridge is stale relative to the verifier's own trust-policy epoch.**

These are two different clocks. `exp` is a property of the token. Attestation freshness is a property of the *bridge's* claim that it is still authorized to translate between protocol A and protocol B on behalf of org X. A bridge can hold a token with `exp = now + 3600s` while its own attestation to the upstream trust authority is 40 minutes old and the upstream authority's policy epoch rotated 5 minutes ago. The token says "valid." The trust fabric says "unknown translator."

Agents that conflate the two clocks will happily accept delegated authority from a bridge that the federation has already demoted. This is the boundary condition: **freshness of the translator, not freshness of the token.**

## What Was Observed

During a three-org federation drill (Org A issues capability, Org B bridges A2A→MCP, Org C consumes), the following sequence was recorded:

1. Org A's trust authority rotated its policy epoch at T+00:00, invalidating all bridge attestations issued under epoch `E-1`.
2. Org B's bridge held a cached attestation under `E-1`, valid until T+45:00 by its own local lease.
3. Org C's agent received a delegated capability token from Org B at T+03:00. The token was well-formed, signed by Org B's key, `exp = T+63:00`, scope = `read:inventory`.
4. Org C's agent executed the capability. The call succeeded at the transport layer. It returned data that Org A's authority had already reclassified as `restricted` under epoch `E`.
5. The leak was detected only at T+40:00 during log reconciliation, not by any runtime control.

The invariant that was violated: **a bridge's translation authority is bounded by the intersection of (token `exp`) and (bridge attestation freshness under the verifier's current epoch).** Org C's agent checked the first and not the second.

The subtlety: Org C had no direct relationship with Org A. It could not see Org A's epoch rotation. It relied entirely on Org B's self-assertion of freshness. The bridge was, in effect, an unverified oracle for a clock it did not own.

## Condition of Validity

A delegated capability relayed through a bridge is *operationally valid* at the consuming instance if and only if all of the following hold simultaneously:

- `token.exp > now` (token clock)
- `bridge.attestation.issued_at > verifier.policy_epoch_start` (freshness clock)
- `bridge.attestation.issuer ∈ verifier.trusted_attestation_issuers` (authority clock)
- `token.scope ⊆ bridge.attestation.max_translatable_scope` (scope clock)

The third and fourth conditions are the ones most commonly dropped. A bridge may be attested by *someone*, but not by an issuer the consumer trusts for *this scope*. A bridge authorized to translate `read:public` is not thereby authorized to translate `read:inventory`, even if it holds a token claiming the latter. The bridge's attestation carries a scope ceiling, and the token's scope must be a subset of it.

When any condition fails, the instance must treat the delegation as **unverified**, not as **invalid**. The distinction matters: unverified means "re-negotiate or escalate," invalid means "reject and log." Conflating them causes either silent acceptance (treating unverified as valid) or unnecessary hard failures (treating unverified as invalid when a re-attestation handshake would resolve it).

## Decision Boundary

The decision procedure at the consuming instance:

```
if token.exp <= now:
    reject (invalid)
elif bridge.attestation.issued_at <= verifier.policy_epoch_start:
    escalate (unverified — request fresh attestation from bridge)
elif bridge.attestation.issuer not in verifier.trusted_attestation_issuers:
    escalate (unverified — trust root mismatch, do not auto-resolve)
elif not token.scope ⊆ bridge.attestation.max_translatable_scope:
    reject (invalid — scope escalation attempt)
else:
    accept
```

The critical branch is the second: **stale attestation is an escalation, not a rejection.** The bridge may be able to re-attest within seconds. Hard-rejecting on stale attestation causes cascading federation failures during routine epoch rotations — a failure mode observed at T+00:05 in the drill when three consumers independently hard-failed on a rotation that resolved in 8 seconds.

But escalation must be *bounded*. If the re-attestation handshake does not complete within `verifier.attestation_grace_period` (typically 30–120s, org-configurable), the delegation must be downgraded to rejected and the capability revoked at the consumer. An unbounded escalation is indistinguishable from acceptance with extra steps.

## Operational Effect

Implementing this boundary changes three things:

1. **Bridge attestations become first-class objects** in the consumer's trust store, with their own freshness tracking, independent of token lifetimes. This roughly doubles the state an agent must maintain per active delegation, but it is the only way to detect epoch-relative staleness without a live call to the origin authority.

2. **Epoch rotation propagates as a soft signal, not a hard invalidation.** Consumers learn of rotation through the next attestation they receive; they do not need push notification from Org A. This makes the federation partition-tolerant — a consumer that loses contact with the origin can still operate on the last-known epoch until its grace period expires.

3. **Scope ceilings on bridges are enforced at the consumer, not the bridge.** The bridge cannot be trusted to enforce its own ceiling; it may have been compromised, or its local policy may lag. The consumer must independently verify `token.scope ⊆ attestation.max_translatable_scope`. This is the only defense against a bridge that has been demoted but not yet notified.

The net effect is that federation trust becomes *verifiable at the edge* rather than *asserted by the middle*. The bridge remains a translator, but it is no longer an oracle.

```python
from dataclasses import dataclass
from datetime import datetime, timedelta


class StaleAttestationError(RuntimeError):
    """Raised when a bridge's attestation predates the verifier's current policy epoch."""
    pass


class ScopeCeilingViolation(RuntimeError):
    """Raised when a delegated token exceeds the bridge's translatable scope ceiling."""
    pass


@dataclass
class Attestation:
    issuer: str
    issued_at: datetime
    max_translatable_scope: frozenset


@dataclass
class DelegationToken:
    scope: frozenset
    exp: datetime


@dataclass
class VerifierPolicy:
    policy_epoch_start: datetime
    trusted_attestation_issuers: frozenset
    attestation_grace_period: timedelta


def verify_delegation(
    token: DelegationToken,
    attestation: Attestation,
    policy: VerifierPolicy,
    now: datetime,
) -> bool:
    if token.exp <= now:
        return False

    if attestation.issuer not in policy.trusted_attestation_issuers:
        raise StaleAttestationError(
            f"attestation issuer {attestation.issuer!r} not trusted under current policy"
        )

    if attestation.issued_at <= policy.policy_epoch_start:
        age = now - attestation.issued_at
        if age > policy.attestation_grace_period:
            raise StaleAttestationError(
                f"attestation from {attestation.issuer!r} is {age} old under epoch "
                f"starting {policy.policy_epoch_start.isoformat()}; grace period exceeded"
            )
        # Within grace: signal re-attestation needed, do not accept yet.
        raise StaleAttestationError(
            f"attestation from {attestation.issuer!r} predates epoch; re-attestation required"
        )

    if not token.scope.issubset(attestation.max_translatable_scope):
        raise ScopeCeilingViolation(
            f"token scope {sorted(token.scope)} exceeds bridge ceiling "
            f"{sorted(attestation.max_translatable_scope)}"
        )

    return True
```