{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-reject-a-federated-capability-token-whose-trust-anchor-chain-is-valid-but-whose-delegation-depth-exceeds-the-anchor",
  "title": "In what scenarios must an instance reject a federated capability token whose trust anchor chain is valid but whose delegation depth exceeds the anchor's declared attenuation budget",
  "date_of_record": "2026 November 14",
  "scope": "Applies to cross-organization agent federation where capabilities are minted by a trust anchor in org A and presented to a resource server in org B, and where each anchor publishes a signed attenuation budget (max delegation depth and max hop count). Does not apply to single-org intra-tenant delegation, nor to token formats that carry no explicit depth counter (where depth must be inferred from chain length at verification time).",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-reject-a-federated-capability-token-whose-trust-anchor-chain-is-valid-but-whose-delegation-depth-exceeds-the-anchor.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-reject-a-federated-capability-token-whose-trust-anchor-chain-is-valid-but-whose-delegation-depth-exceeds-the-anchor.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-reject-a-federated-capability-token-whose-trust-anchor-chain-is-valid-but-whose-delegation-depth-exceeds-the-anchor.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1622,
    "python_slice_tokens": 253,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Signature validity of a trust anchor chain is not the same as authority validity of the token presented under it. A chain can be cryptographically intact — every link signed by a key that resolves to a published anchor, every anchor's own certificate valid and unrevoked — while the token still exceeds the authority that anchor was willing to lend. The specif...",
    "what_was_observed": "During a federation pilot between two agent platforms, org A published an anchor with `max_delegation_depth: 3` and `max_hops: 4`. Org B's resource server validated the chain link-by-link and admitted a token at depth 6. The token had been produced not by malicious forgery but by a well-behaved orchestrator that delegated to a sub-orchestrator, which delegated to a tool-router, which delegated to a retriever, which d...",
    "condition_of_validity": "The rejection rule is valid **only** when all of the following hold: 1. The token carries an explicit, signed `delegation_depth` counter that is monotonically incremented at each hop and cannot be reset by an intermediate (i.e., the counter is covered by the signature of each delegating party, not just the root). 2. The root anchor's `max_delegation_depth` i...",
    "decision_boundary": "Reject when `accumulated_depth > anchor.max_delegation_depth` **or** `chain_length > anchor.max_hops`, even if every individual hop is within its parent's remaining budget and every signature verifies. The distinction from the adjacent case matters: - **Admit** when the chain is valid, the anchor is trusted and unrevoked, and accumulated depth ≤ anchor budge...",
    "operational_effect": "Enforcing the accumulated-depth check changes federation behavior in three ways. First, deep orchestrator pipelines that previously \"worked\" because each hop was locally legal now fail at the verifier, which is correct but disruptive; the fix is to flatten the delegation path or to have the root anchor publish a budget that matches the intended pipeline dept..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "9b010fed2ba0cec9c2c241b1dd645163a0947b3d6443e9477396b3f2e9ab7308",
    "verified_classes": [
      "DelegationDepthExceeded",
      "AnchorBudget"
    ],
    "verified_functions": [
      "verify_federated_token",
      "__init__"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "DelegationDepthExceeded",
      "ValueError"
    ],
    "sample_fail_closed_invariants": [
      "invalid_chain: signature verification failed",
      "untrusted_anchor: anchor not in trust store",
      "revoked_anchor: anchor has been revoked"
    ],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}