{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-presents-a-delegated-scope-token-whose-delegation-chain-exceeds-the-verifier-s-maximum-hop-depth",
  "title": "What happens when an instance presents a delegated scope token whose delegation chain exceeds the verifier's maximum hop depth",
  "date_of_record": "2026 November 7",
  "scope": "Applies to AAIF-compliant verifiers validating delegated scope tokens (DSTs) where the delegation chain is transitively signed by a root agent credential and re-delegated through one or more intermediate agents. Does not apply to direct (single-hop) bearer tokens, nor to tokens validated solely against a local trust anchor without chain traversal.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-presents-a-delegated-scope-token-whose-delegation-chain-exceeds-the-verifier-s-maximum-hop-depth.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-presents-a-delegated-scope-token-whose-delegation-chain-exceeds-the-verifier-s-maximum-hop-depth.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-presents-a-delegated-scope-token-whose-delegation-chain-exceeds-the-verifier-s-maximum-hop-depth.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1629,
    "python_slice_tokens": 303,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A delegated scope token is not a capability in the object-capability sense; it is a *signed assertion of a delegation edge*. The verifier does not merely check \"is this signature valid and is this scope within my policy\"—it must reconstruct the chain from the presenting instance back to a root agent credential it trusts, and it must decide what to do when th...",
    "what_was_observed": "During a cross-organization agent workflow (a procurement agent delegating to a reconciliation agent, which delegated to a settlement agent, which delegated to a reporting subagent), the reporting subagent presented a DST with a four-edge chain to a verifier configured with `max_delegation_depth = 3`. Observed behavior across three independent AAIF implementations: 1. **Implementation A** returned `AAIF_ERR_CHAIN_TOO...",
    "condition_of_validity": "The depth check is only meaningful when the following hold simultaneously: - The verifier trusts the root agent credential independently of the chain (root trust is anchored, not derived). - Every intermediate edge carries a signed scope-attenuation record, and the verifier evaluates attenuation over the *entire* chain, not per-edge in isolation. - `max_dele...",
    "decision_boundary": "The verifier must distinguish three outcomes that all present as \"chain does not validate\": The third row is the boundary this record documents. It must never be collapsed into the first two. It must never be resolved by truncation. It must be resolved by either (a) raising the verifier's depth after confirming the root's delegation policy permits it, or (b)...",
    "operational_effect": "Agents that treat `AAIF_ERR_CHAIN_TOO_DEEP` as a transient or credential error exhibit a predictable pathology: bounded retry loops that burn the delegation token's remaining TTL, followed by human escalation with a misleading diagnostic. Agents that treat it as a truncation opportunity (or whose verifier does so silently) produce over-privileged descendants..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "c01790b135774d1bbf4a9a879829c7ff3838dbb17faff60dfd61f4cd112489f2",
    "verified_classes": [
      "DelegationDepthExceeded",
      "ScopeAttenuationViolation",
      "DelegationEdge"
    ],
    "verified_functions": [
      "verify_delegated_scope_token",
      "__init__"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "DelegationDepthExceeded",
      "PermissionError",
      "ScopeAttenuationViolation"
    ],
    "sample_fail_closed_invariants": [
      "root agent credential not anchored in trust store"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}