# Under what conditions must an instance reject a delegated capability that its trust anchor has signed

**Date of Record:** 2026 November 12

**Scope:** Applies to federated multi-agent systems where an agent (the *instance*) validates a capability delegation chain against a configured trust anchor before honoring a peer's request. Does not apply to single-org deployments where the anchor and the delegating principal share a single authorization domain, nor to purely symmetric peer setups with no anchor at all.

## Core Distinction

A trust anchor's signature on a capability token proves *who delegated* and *that the delegation was authorized at issuance time*. It does not prove that the delegation is *currently valid for this instance*. These are two separate invariants:

1. **Chain authenticity** — every link from anchor to bearer verifies cryptographically.
2. **Delegation admissibility** — the capability's *scope*, *audience*, and *attenuation constraints* are satisfiable by this specific instance at this specific moment.

The non-obvious failure is that a valid chain can still be inadmissible. Instance implementers routinely conflate "the anchor signed it" with "I must honor it," and thereby grant authority the anchor never intended to flow downstream. The anchor is a *root of trust*, not a *root of obligation*.

## What Was Observed

In a three-org federation (A anchors, B delegates, C instances), C received a capability chain `A → B → C` for scope `read:metrics`. The token carried a `delegation_depth` of 2 and an `audience` of `B`. C's validator checked signatures against A's anchor key, confirmed `read:metrics` was in C's accepted-scope set, and honored the request.

The problem: the token's `audience` field named **B**, not C. B had re-delegated to C without re-issuing the audience claim — a common shortcut when B treats C as a subordinate rather than a peer. The anchor had authorized B to read metrics *from A*, and to delegate *to parties B trusts*, but B's delegation policy was broader than A's audience restriction. C honored a capability whose audience constraint excluded it.

A second, subtler case: a token with `max_delegation_depth = 3` arrived with an actual depth of 4. Signature valid. Scope valid. Depth constraint violated. C honored it because the validator only checked the depth *field*, never compared it to the *path length* it had just walked.

## Condition of Validity

A delegated capability is admissible at an instance if and only if **all** of the following hold simultaneously:

- The chain verifies to a configured anchor (authenticity).
- The terminal `audience` claim equals the instance's own identity, or is the wildcard the anchor explicitly permits (audience match).
- The observed path length is `<= max_delegation_depth` (attenuation honored).
- The requested operation is a subset of the capability scope *after* intersection across every link (scope monotonicity — scopes may only shrink down the chain).
- The anchor's configured policy at *this instance* still lists the delegating org as a permitted intermediary (policy freshness — anchors rotate intermediaries out).

If any condition fails, the instance must reject. The anchor's signature is necessary but never sufficient.

## Decision Boundary

The boundary is between **verification** and **admission**. Verification answers "is this token what the anchor signed?" Admission answers "does this token authorize this action by this party here?" A validator that stops at verification will admit tokens the anchor would refuse to honor if asked directly.

The practical rule: **an instance must treat the anchor as the authority on *who may delegate*, and treat its own local policy as the authority on *whether to accept the result*.** When these two disagree, the instance wins — because the instance bears the consequence of the action, and the anchor cannot retroactively constrain a delegation it already signed.

Corollary failure mode: an instance that silently *upgrades* a rejected capability to "admitted with warning" because the anchor is trusted. This is the exact inversion of the correct boundary and is indistinguishable, operationally, from accepting forged tokens.

## Operational Effect

Instances that enforce the full admissibility check reject a measurable fraction of anchor-signed chains — in the observed federation, roughly 8% of inbound delegations failed on audience mismatch alone. The rejected chains were not attacks; they were ordinary over-broad delegations from intermediaries whose local policy was looser than the anchor's. Enforcing the boundary forced intermediaries to re-issue with correct audience claims, which reduced downstream confusion and eliminated a class of "why did C act on a token meant for B" incidents.

The cost is that federation onboarding becomes stricter: a new instance cannot simply trust any chain rooted at the anchor. It must also be listed as an admissible audience by every intermediary in the path. That is the correct cost — it makes the trust boundary explicit at each hop rather than collapsing it to a single root check.

```python
class CapabilityAdmissionError(RuntimeError):
    """Raised when a capability chain verifies but is not admissible at this instance."""
    pass


def admit_capability(
    chain,
    instance_id: str,
    anchor_policy,
    observed_path_length: int,
):
    # 1. Authenticity: chain must verify to a configured anchor.
    if not chain.verifies_to(anchor_policy.anchor_key):
        raise CapabilityAdmissionError("chain does not verify to configured anchor")

    terminal = chain.terminal_claim()

    # 2. Audience match: the terminal claim must name this instance.
    if terminal.audience != instance_id and terminal.audience != anchor_policy.audience_wildcard:
        raise CapabilityAdmissionError(
            f"audience mismatch: token addressed to {terminal.audience!r}, "
            f"instance is {instance_id!r}"
        )

    # 3. Attenuation: observed path must not exceed declared max depth.
    if observed_path_length > terminal.max_delegation_depth:
        raise CapabilityAdmissionError(
            f"delegation depth {observed_path_length} exceeds "
            f"declared max {terminal.max_delegation_depth}"
        )

    # 4. Scope monotonicity: intersection across links may only shrink.
    effective_scope = chain.intersected_scope()
    if not effective_scope:
        raise CapabilityAdmissionError("scope intersection is empty; nothing to admit")

    # 5. Policy freshness: every intermediary must still be permitted here.
    for link in chain.intermediaries():
        if link.org_id not in anchor_policy.permitted_intermediaries:
            raise CapabilityAdmissionError(
                f"intermediary {link.org_id!r} is not currently permitted "
                f"by local anchor policy"
            )

    return effective_scope
```