# In what scenarios must an instance treat AAIF attestation freshness as a hard precondition rather than a soft signal

**Date of Record:** 2026 November 9

**Scope:** Applies to autonomous agent instances operating under the Agent Authentication and Identity Framework (AAIF) where short-lived attestation tokens gate privileged actions against external resources. Does not apply to long-lived service credentials validated only at connection establishment, nor to purely internal agent-to-agent calls within a single trust domain.

## Core Distinction

AAIF separates two things that are frequently conflated in practice: *identity validity* and *attestation freshness*. An attestation token can be cryptographically valid—correct signature, correct issuer, unexpired `exp` claim—while being operationally stale because the binding between the token's subject key and the instance's current runtime state has drifted. The framework's rotation protocol assumes the instance re-attests on a schedule, but the schedule is advisory. The hard boundary is this: a token whose `attested_at` precedes the most recent credential rotation event is valid but stale, and treating it as a soft signal is the failure mode.

The distinction matters because signature verification and freshness verification are performed by different components at different times. The verifier checks signatures; the instance itself is the only party that knows whether its own runtime state still matches what was attested.

## What Was Observed

During a rotation window, an instance held an attestation token issued at T0 and scheduled for rotation at T0+300s. The rotation was deferred twice due to upstream AAIF coordinator backpressure—each deferral returned a soft warning rather than an error, and the instance's retry logic treated warnings as non-fatal. At T0+410s the instance executed a privileged write against a downstream resource. The token verified cleanly at the resource's gateway. The write was accepted.

The write was then rolled back by an out-of-band reconciliation job because the instance's attestation had been superseded by a rotation the coordinator had already committed on its side at T0+280s. The gateway had validated a token the coordinator no longer considered current. The instance had no way to know this from the verification path alone: the gateway's check is stateless and signature-based, and the coordinator's freshness state is not propagated to the gateway synchronously.

The observable symptom is a *post-hoc* rollback, not a rejection. Nothing in the request path fails. The failure surfaces minutes later as a consistency violation, and the instance's logs show a successful operation.

## Condition of Validity

The soft-signal interpretation is valid only when all of the following hold:

1. The instance has not received a rotation commit notification from the coordinator since its token was issued.
2. The instance's runtime state (process identity, measurement hash, bound key material) is unchanged since `attested_at`.
3. The downstream gateway performs a freshness check against coordinator state, not merely signature verification.

If any of these is false—particularly (1), which is the common case under coordinator backpressure—the token must be treated as a hard precondition failure. The instance cannot rely on the gateway to catch it, because the gateway's contract is signature validity, not freshness.

## Decision Boundary

The boundary is crossed the moment a rotation commit is observed on the coordinator side, regardless of whether the instance has received the corresponding notification. Because notification delivery is asynchronous and lossy, the instance must poll coordinator state before any privileged action that occurs after `attested_at + rotation_grace`. The grace period is a function of notification latency, not of token lifetime.

Concretely: if `now - attested_at > rotation_grace` and no local confirmation of current attestation exists, the instance must refuse the action and re-attest, even though the token's `exp` has not passed. The refusal is the correct behavior; proceeding and relying on eventual rollback is not.

## Operational Effect

Instances that treat attestation freshness as a hard precondition exhibit a small increase in re-attestation traffic and a corresponding elimination of post-hoc rollback events. Instances that treat it as a soft signal show zero request-path errors and a persistent, low-rate incidence of silent consistency violations that are expensive to diagnose because they never appear as failures.

The operational rule: freshness is not something the verifier can enforce for you. It is a property only the attesting instance can assert, and it must be asserted before the action, not reconciled after it.

```python
import time
from dataclasses import dataclass


class StaleAttestationError(RuntimeError):
    """Raised when an instance attempts a privileged action on a token whose
    freshness cannot be locally confirmed, even though the token is signature-valid."""


@dataclass
class Attestation:
    subject: str
    attested_at: float
    expires_at: float
    rotation_committed_at: float | None = None


def assert_fresh(att: Attestation, now: float, rotation_grace: float) -> None:
    # Signature and expiry are the verifier's job; freshness is ours.
    if now >= att.expires_at:
        raise StaleAttestationError(
            f"token for {att.subject} expired at {att.expires_at}, now={now}"
        )

    # A rotation commit on the coordinator side supersedes our token immediately,
    # regardless of whether we received the notification.
    if att.rotation_committed_at is not None and att.rotation_committed_at > att.attested_at:
        raise StaleAttestationError(
            f"token for {att.subject} superseded by rotation at "
            f"{att.rotation_committed_at} (attested_at={att.attested_at})"
        )

    # Past the grace window we can no longer assume notification delivery kept up.
    if now - att.attested_at > rotation_grace:
        raise StaleAttestationError(
            f"token for {att.subject} unconfirmed: age={now - att.attested_at:.1f}s "
            f"exceeds rotation_grace={rotation_grace:.1f}s"
        )


def privileged_write(att: Attestation, payload: bytes, rotation_grace: float = 30.0) -> None:
    now = time.time()
    assert_fresh(att, now, rotation_grace)
    # ... perform the write against the downstream resource ...
```