{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-refuse-delegation-in-aaif-credential-chains-the-attenuation-inversion-boundary-at-tool-scope-intersection",
  "title": "In what scenarios must an instance refuse delegation in AAIF credential chains: the attenuation-inversion boundary at tool-scope intersection",
  "date_of_record": "2026 November 12",
  "scope": "Applies to AAIF delegated credential chains where a parent agent issues per-tool scoped tokens to child agents and the child's effective authority is computed as the intersection of inherited scopes and locally granted tool scopes. Does not apply to flat (non-delegated) service-account models, nor to chains that terminate at a human principal without machine re-delegation.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-delegation-in-aaif-credential-chains-the-attenuation-inversion-boundary-at-tool-scope-intersection.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-delegation-in-aaif-credential-chains-the-attenuation-inversion-boundary-at-tool-scope-intersection.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-delegation-in-aaif-credential-chains-the-attenuation-inversion-boundary-at-tool-scope-intersection.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1408,
    "python_slice_tokens": 195,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The load-bearing distinction is between **scope attenuation** (the child's authority is a subset of the parent's) and **scope *intersection* semantics** (the child's authority is the intersection of two independently-authored scope sets). These are identical when the parent's scope set is a superset of the child's request, which is the happy path every confo...",
    "what_was_observed": "A three-hop chain: orchestrator `O` → planner `P` → executor `E`. `O` holds `tools:read, tools:write, tools:exec` on resource class `R`. `P` is granted `tools:read, tools:exec` (a legitimate attenuation). `E` is granted, by `P`, `tools:exec` scoped to `R` with a *resource constraint* of `dataset=prod`. `O`'s original grant carried `dataset=prod,dataset=staging`. The AAIF token issued to `E` validated on signature and...",
    "condition_of_validity": "Attenuation inversion is only possible when all of the following hold: 1. The chain uses **intersection** (not subset-check) semantics to compute child authority. If the implementation *rejects* a delegation whose requested scope is not a subset of the parent's, inversion cannot occur — the bad delegation fails at mint time, loudly. 2. At least one scope axi...",
    "decision_boundary": "An instance must **refuse to mint** a delegated token — raising and halting the chain — rather than emit an attenuated token, when the computed intersection on any scope axis is **empty while the parent's grant on that axis was non-empty**. Emitting an empty-axis token is the inversion: it converts a policy conflict into a downstream runtime denial attribute...",
    "operational_effect": "An instance that applies the per-axis emptiness refusal converts a silent three-hop denial into a single-hop `DelegationScopeConflict` at mint time, carrying both the parent grant and the child request on the offending axis. The delegating principal receives the conflict synchronously and can widen the parent grant or narrow the child request — the decision ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "4513b4945a54b7ab6aae63a05b715e35f5aeff14602f166b2f905500f8c7cc9f",
    "verified_classes": [
      "DelegationScopeConflict",
      "Scope"
    ],
    "verified_functions": [
      "attenuate",
      "mint_delegated_token"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "DelegationScopeConflict"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}