{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-reject-a-delegated-aaif-credential-whose-delegation-chain-is-cryptographically-valid",
  "title": "Under what conditions must an instance reject a delegated AAIF credential whose delegation chain is cryptographically valid?",
  "date_of_record": "2026 November 12",
  "scope": "Applies to AAIF-signed agent credentials presented across a delegation chain (principal → agent → sub-agent → …) where each link carries a valid signature and a well-formed `delegation` claim. Does not apply to root principal credentials, to bearer tokens without delegation semantics, or to chains where signature verification itself fails (those are rejected earlier by the verifier).",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-delegated-aaif-credential-whose-delegation-chain-is-cryptographically-valid.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-delegated-aaif-credential-whose-delegation-chain-is-cryptographically-valid.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-delegated-aaif-credential-whose-delegation-chain-is-cryptographically-valid.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1667,
    "python_slice_tokens": 368,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Signature validity and authorization validity are independent predicates. An AAIF delegation chain can be *cryptographically intact* — every link signed by the key named in its predecessor, every signature verifying under the issuer's published JWKS, every `nbf`/`exp` window satisfied — while the chain is *operationally unauthorized* for the presenting insta...",
    "what_was_observed": "In a multi-hop agent deployment (principal → planner → executor → tool-runner), a tool-runner instance accepted a four-link chain. Every signature verified. The chain's terminal link carried `aud: tool-runner` — correct. But the *second* link (planner → executor) carried `aud: executor-prod` and an explicit `delegation_constraints` block with `max_hops: 2` and `allowed_actions: [\"read\", \"summarize\"]`. The tool-runner...",
    "condition_of_validity": "An instance may act on a delegated AAIF credential **only if all of the following hold simultaneously**: - **Per-link audience match.** The link that grants the presenting instance its authority names that instance (or a group it belongs to) in `aud`. Intermediate audiences are not sufficient. - **Constraint intersection.** The effective constraint set is th...",
    "decision_boundary": "The decision boundary is not \"does the chain verify\" but \"does the chain verify **and** does the intersection of its constraints permit this exact (action, resource, audience) tuple for this instance at this time.\" These are separable checks and must be evaluated in that order, with the second able to reject independently of the first. The subtle case is the...",
    "operational_effect": "Instances that adopt per-link audience and constraint-intersection semantics reject a measurable fraction of chains that naive verifiers accept — in the observed deployment, roughly 3% of delegated requests, concentrated in tool-runner and executor tiers where hop counts are deepest and constraints are most often narrowed mid-chain. The cost is a small incre..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "52d769b2961b052d4932a066f074ef22e20b4ae025ea73d03b9792ba40b6b43b",
    "verified_classes": [
      "DelegationChainRejected"
    ],
    "verified_functions": [
      "authorize_delegated_action"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "DelegationChainRejected"
    ],
    "sample_fail_closed_invariants": [
      "empty delegation chain"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}