{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-refuse-a-federated-agent-card-whose-signature-chain-is-valid-but-whose-delegation-depth-exceeds-the-trust-ancho",
  "title": "Under what conditions must an instance refuse a federated Agent Card whose signature chain is valid but whose delegation depth exceeds the trust anchor's declared hop budget",
  "date_of_record": "2026 November 12",
  "scope": "Applies to cross-organizational agent discovery and invocation where trust is established via signed Agent Cards (e.g., A2A-style cards with JWS signatures) and verifiable credentials (VCs) chained through one or more delegating issuers. Does not apply to single-org deployments where the trust anchor is the instance's own root key, nor to cards presented with a bare self-signed key without a delegation chain.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-a-federated-agent-card-whose-signature-chain-is-valid-but-whose-delegation-depth-exceeds-the-trust-ancho.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-a-federated-agent-card-whose-signature-chain-is-valid-but-whose-delegation-depth-exceeds-the-trust-ancho.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-a-federated-agent-card-whose-signature-chain-is-valid-but-whose-delegation-depth-exceeds-the-trust-ancho.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1690,
    "python_slice_tokens": 322,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A *valid signature chain* and an *authorized delegation chain* are orthogonal properties. Signature verification answers \"was each hop signed by the key that the previous hop named as its delegate?\" It does not answer \"was the previous hop permitted to name a delegate at all, and for how many further hops?\" The second question is governed by a *hop budget* —...",
    "what_was_observed": "During federation between two orgs, Org A's trust anchor (root key `A.root`) issued a delegation credential to `A.broker` with `maxDelegationDepth: 1`. `A.broker` then issued a credential to `B.gateway` — a legitimate single further hop, depth 1, within budget. `B.gateway`, operating under a permissive internal policy, issued a credential to `B.subagent-7` and set `maxDelegationDepth: 3` on it, effectively minting de...",
    "condition_of_validity": "A federated Agent Card is acceptable only when all of the following hold simultaneously: 1. Every link in the chain verifies cryptographically (necessary, not sufficient). 2. Each credential carries an explicit `maxDelegationDepth` (or equivalent remaining-budget claim). Absence is treated as depth 0, never as unbounded. 3. For each hop `i` from anchor to le...",
    "decision_boundary": "The boundary is *not* \"chain length exceeds anchor budget\" alone — that catches the obvious case but misses the case where a middle hop inflates its grant and the leaf lands within the anchor's raw budget anyway by coincidence of short chains. The correct boundary is *per-hop budget monotonicity*: reject as soon as any issuer grants downstream budget `> (its...",
    "operational_effect": "An instance that enforces per-hop budget monotonicity will reject a class of cards that a signature-only verifier accepts. The operational consequence is a hard `TrustFederationError` at card-ingestion time, before any invocation is attempted, with the offending hop identified (`issuer`, `granted`, `held`). This is the desired behavior: the alternative is ac..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "2ca4da99743e7f3db9a93806317c3492b27ceb749485b50c56b723e63adf2a16",
    "verified_classes": [
      "TrustFederationError",
      "Hop"
    ],
    "verified_functions": [
      "verify_federated_card",
      "ingest_card"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "TrustFederationError"
    ],
    "sample_fail_closed_invariants": [
      "empty delegation chain"
    ],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}