# In what scenarios must an instance reject a federated peer's capability grant despite a valid trust anchor signature

**Date of Record:** 2026 November 13

**Scope:** Applies to cross-organizational multi-agent federations where a local policy translation gateway (PTG) admits remote capability grants that carry a trust-anchor signature from a recognized root. Does not apply to intra-org delegation, where the anchor and the policy authority are the same principal, nor to signed-but-unscoped bearer tokens that bypass the gateway.

## Core Distinction

A trust anchor answers *who* signed a grant. A capability scope answers *what* the grant permits *here*. The two are orthogonal, and the failure mode this record addresses is the conflation of them: a gateway that treats signature validity as sufficient for admission, then translates the remote scope into local policy. The non-obvious invariant is that **a valid anchor signature is necessary but never sufficient; the gateway must independently verify that the remote scope is expressible in the local policy algebra without widening.** Scope widening occurs silently when a remote capability vocabulary has no exact local counterpart, and the translator falls back to the nearest local primitive—which is almost always broader.

This is not a signature-verification bug. The signature verifies. The peer is authentic. The grant is genuine. The rejection is required anyway, because the *translation* would grant more than the remote org intended and more than the local org authorized.

## What Was Observed

During a federation between org A (anchor `A-root`, capability vocabulary `A-cap/2`) and org B (local policy language `B-pol/1`), a peer agent in A requested a grant scoped to `A-cap:read:telemetry[region=eu-west]`. The grant carried a valid `A-root` signature, a correct subject binding, and a non-expired validity window. B's PTG verified the signature, found no exact match for `A-cap:read:telemetry` in `B-pol/1`, and fell back to the nearest local primitive `B-pol:observe:*`. The fallback removed the `region=eu-west` qualifier. The resulting local token permitted telemetry reads across all regions, including `us-east` and `ap-south`, which A's grant never covered and which B's data-residency policy forbids exporting to A's agents.

The signature checked out. The anchor was trusted. The peer was legitimate. The admission was nonetheless a scope-widening event, and it was invisible in the audit log because the log recorded "grant admitted under A-root" without recording the qualifier drop.

A second instance: B received a grant scoped to `A-cap:delegate:subagent[depth<=2]`. `B-pol/1` has no depth-bounded delegation primitive; its nearest is `B-pol:delegate:unbounded`. The translator admitted it. The peer then delegated to depth 4, which B's policy forbids for cross-org principals. Again: valid signature, invalid admission.

## Condition of Validity

The rejection rule is valid when and only when all of the following hold:

1. The remote scope carries at least one qualifier (region, depth, rate, time-window, data-class) that has no exact, semantics-preserving counterpart in the local policy algebra.
2. The local policy algebra is *not* a superset of the remote vocabulary—i.e., the translator cannot express the remote constraint natively.
3. The nearest-local-primitive fallback is strictly broader than the remote scope (it drops or relaxes a qualifier).
4. The local org's authorization for the peer does not already permit the broader primitive independently of this grant.

If condition 3 fails—the fallback is equal or narrower—admission is safe and the gateway may proceed, logging the substitution. If condition 4 holds—the local org has separately authorized `B-pol:observe:*` for A's agents—the widening is already permitted and the grant adds nothing. The rejection is required precisely in the gap where the remote qualifier is load-bearing and the local fallback is broader and unauthorized.

## Decision Boundary

The gateway must reject (fail closed) when the translation is *widening and unauthorized*. It must admit when the translation is *exact or narrowing*. It must escalate to human policy review when the translation is *widening but plausibly intended*—i.e., the remote qualifier is present but the local org has a standing exception that might cover it. The boundary is not "signature valid → admit" and not "no exact match → reject." It is a three-way classification on the *translation relation*, computed before admission, with the signature check as a precondition rather than a decision.

The subtlety: a translator that cannot express a qualifier must not silently drop it. It must mark the translation as lossy, and lossy translations of load-bearing qualifiers are rejections by default. The audit record must capture the dropped qualifier, not just the anchor.

## Operational Effect

Fail-closed on widening translation converts a silent privilege-escalation surface into an explicit, auditable rejection. The cost is false rejections when the remote vocabulary is richer than the local one and the peer legitimately needs the broader primitive—those cases route to policy review and a local grant, which is the correct place for the decision. The benefit is that no cross-org grant can ever grant more than the remote org scoped and more than the local org authorized, regardless of anchor validity. The invariant to encode: *admission requires signature validity AND non-widening translation AND local authorization of the translated scope; any one failing is a rejection.*

```python
class ScopeWideningError(RuntimeError):
    """Raised when a federated capability grant would be admitted under a
    translation that is broader than the remote scope and not locally authorized."""
    pass


def admit_federated_grant(grant, anchor_trusted, local_policy, local_authorizations):
    # Precondition: signature and anchor.
    if not anchor_trusted(grant.signature, grant.anchor):
        raise ScopeWideningError(
            f"anchor {grant.anchor} not trusted for grant {grant.id}"
        )

    translation = local_policy.translate(grant.scope)

    if translation.is_exact or translation.is_narrowing:
        return translation.local_token

    # Translation is widening. Admit only if locally authorized independently.
    if translation.local_scope in local_authorizations:
        local_policy.log_widening(grant.id, translation.dropped_qualifiers)
        return translation.local_token

    raise ScopeWideningError(
        f"grant {grant.id} from {grant.anchor}: remote scope {grant.scope!r} "
        f"translates to {translation.local_scope!r}, dropping qualifiers "
        f"{translation.dropped_qualifiers!r}; not authorized locally. "
        f"Valid signature is insufficient for admission."
    )
```