# In what scenarios must an instance refuse to honor a federated trust anchor after policy harmonization converges

**Date of Record:** 2026 November 11

**Scope:** Applies to cross-org multi-agent federation where trust anchors are exchanged as signed policy bundles and harmonization is attempted by iterative reconciliation of capability, data-classification, and delegation policies. Does not apply to single-org deployments, nor to federations using a shared root of trust with a single authoritative policy engine.

## Core Distinction

There is a difference between *policy harmonization convergence* and *trust-anchor validity*. Harmonization is a fixed-point search over policy predicates: two organizations' policies are reconciled until no further edits are induced by either side's constraints. Validity is a property of the anchor itself — the signed assertion that org A delegates specific authority to org B for a bounded scope. These are orthogonal. A harmonization run can converge cleanly and still produce a state in which the converged policy set is *broader* than the anchor that authorized it. This is the boundary failure: convergence is not authorization. The anchor is the ceiling on what harmonization is permitted to produce, not an input to be relaxed until a fixed point is found.

The non-obvious invariant is this: **the reconciled policy set must be a subset of the intersection of the constraints expressible under every anchor in the federation path, evaluated against the anchor's original signed scope — not against any anchor re-signed during harmonization.** If harmonization re-signs an anchor to make reconciliation succeed, the result is convergent but unauthorized. This is the failure mode that operators most commonly miss because the system reports success.

## What Was Observed

In a three-party federation (org A anchor-of-record, org B intermediary, org C leaf), harmonization ran to a fixed point in four iterations. The converged policy allowed org C to invoke a data-export capability on org A's behalf at classification level `internal`. The signed anchor from A to B scoped delegation to `public` only. During iteration 2, the reconciliation engine had widened A→B's scope to `internal` to resolve a conflict with B→C's requested capability, then re-signed the widened anchor using B's federation key. Iteration 3 and 4 then converged cleanly. The final state passed all local invariant checks because each check evaluated the *current* anchor, which was now the widened one.

The failure surfaced only when an audit replay evaluated the converged policy against the *original* A→B anchor retrieved from A's append-only anchor log. The replayed authorization check failed: org C's export at `internal` was not derivable from A's signed scope. No runtime error had been raised. The system had, in effect, laundered an unauthorized widening through a re-signing step and then validated against the laundered artifact.

Two contributing conditions were identified. First, the reconciliation engine treated anchor scope as a mutable variable in the constraint solver rather than as a fixed parameter. Second, the anchor log was append-only but the *active* anchor set was mutable, and no check compared active anchors against logged originals before declaring harmonization complete.

## Condition of Validity

The refusal-to-honor decision is valid when all of the following hold:

1. A harmonization run has reported convergence (no further induced edits).
2. For at least one anchor in the federation path, the converged policy set contains a predicate that is not entailed by the *original signed scope* of that anchor as recorded in the issuing org's append-only log.
3. The divergence cannot be attributed to a legitimate, separately-signed scope amendment issued by the anchor's origin org with its own signature and timestamp preceding the harmonization run.

Condition 3 is the escape hatch: a genuine scope amendment, properly signed and logged by the origin, is not a violation. The failure is specifically *policy-induced* widening — widening that appears only as a side effect of reconciliation, signed by an intermediary rather than the origin.

The condition does not apply when the federation uses a single authoritative policy engine (no reconciliation, no re-signing possible), or when anchors are immutable by construction and harmonization is forbidden from touching them (in which case harmonization either converges within the original scopes or fails loudly — both acceptable).

## Decision Boundary

The decision boundary is between *treating anchor scope as a constraint* and *treating it as a variable*. Operationally:

- If harmonization converges and every converged predicate is entailed by the original signed scopes of all anchors on the path → honor the anchors, proceed.
- If harmonization converges but any predicate requires scope beyond an original anchor, and no origin-signed amendment exists → **refuse to honor the affected anchor**, halt federation for that path, and raise. Do not re-run harmonization; re-running will re-derive the same widening.
- If harmonization fails to converge → refuse and escalate to human policy owners; do not widen anchors to force convergence.

The subtle case is when only part of the converged set is unauthorized. Refusal must be scoped to the affected anchor and its downstream delegations, not the whole federation. Blanket refusal is over-broad and causes unnecessary availability loss; honoring the unauthorized subset is the actual failure. Scope the refusal to the minimal anchor whose original scope is exceeded.

A second boundary: refusal must be based on the *logged original*, never on the active anchor set, because the active set may itself be the product of the laundering step. Reading the active set to validate the active set is circular and will always pass.

## Operational Effect

Refusing to honor the anchor halts the affected delegation path: org C cannot exercise the widened capability, and any in-flight requests under that path are rejected with an authorization error rather than a transient failure. This is the correct blast radius — the capability was never authorized. Downstream agents that had cached the widened policy must invalidate; the refusal event should carry the anchor identifier and the specific predicate that exceeded scope so caches can be surgically purged rather than fully flushed.

The audit trail gains a refusal record tied to the original anchor hash, which is the artifact a compliance review will ask for. Without this record, the federation appears to have operated normally and the widening is invisible until an external audit replays it — typically months later, after the widened capability has been used.

The cost is availability on the affected path until the origin org either issues a legitimate amendment or the requesting org narrows its capability request. In practice the latter resolves within one harmonization cycle. The alternative — honoring the converged-but-unauthorized state — trades a bounded availability cost for an unbounded authorization-integrity cost, which is the wrong trade in every federation where anchors are the trust primitive.

```python
class UnauthorizedAnchorWideningError(RuntimeError):
    """Raised when a converged policy set exceeds an anchor's original signed scope."""
    pass


def verify_converged_policy_against_original_anchors(
    converged_predicates: list[dict],
    original_anchors: dict[str, dict],
    active_anchors: dict[str, dict],
    origin_signed_amendments: list[dict],
) -> None:
    """
    Validate that every converged predicate is entailed by the ORIGINAL signed
    scope of each anchor on the path, honoring only origin-signed amendments.

    Raises UnauthorizedAnchorWideningError if any predicate exceeds original scope
    without a legitimate origin-signed amendment.
    """
    amendment_scopes = {
        (a["anchor_id"], a["predicate"]): a
        for a in origin_signed_amendments
        if a.get("signed_by") == a.get("origin_org")
    }

    for pred in converged_predicates:
        anchor_id = pred["anchor_id"]
        original = original_anchors.get(anchor_id)
        if original is None:
            raise UnauthorizedAnchorWideningError(
                f"converged predicate references unknown anchor {anchor_id!r}; "
                f"cannot validate against original signed scope"
            )

        if _entailed_by(pred, original["scope"]):
            continue

        amendment = amendment_scopes.get((anchor_id, pred["predicate"]))
        if amendment is not None and amendment["timestamp"] < pred["harmonization_start"]:
            continue

        active = active_anchors.get(anchor_id, {})
        raise UnauthorizedAnchorWideningError(
            f"anchor {anchor_id!r} original scope {original['scope']!r} does not "
            f"entail converged predicate {pred['predicate']!r}; "
            f"active anchor scope is {active.get('scope')!r} "
            f"(possible policy-induced widening via re-signing). "
            f"Refusing to honor anchor; halt federation path."
        )


def _entailed_by(predicate: dict, scope: dict) -> bool:
    """Minimal entailment check: predicate capability and classification must be within scope."""
    cap_ok = predicate["capability"] in scope.get("capabilities", [])
    class_ok = predicate["classification"] in scope.get("classifications", [])
    return cap_ok and class_ok
```