What invariants prevent cross-session trust inheritance from being exploited by successors?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session inherits trust established by a predecessor session (same principal, same peer, or same resource), and the trust inheritance can be exploited—a successor inherits trust it did not earn, or a peer exploits the trust inheritance to gain access it should not have. Does not apply to sessions with strictly isolated trust or sessions where trust is cryptographically bound to a specific session.

Core Distinction

The separation between **trust attribution** (trust attributed to the principal across sessions) and **trust continuity** (the trust continues to be valid across session boundaries). Relying on attribution creates the **Session Boundary Bleed**: trust earned in one session is inherited by the successor session, but the trust was earned under conditions that the successor may not share (different context, different peers, or different operational mode), and the inherited trust is exploited.

What Was Observed

In session-inheriting agent architectures, failing to preserve trust boundaries produces three primary failure modes:

  1. **Predecessor Reputation Misuse:** The predecessor earned trust with a peer. The successor inherits the trust and uses it for actions the predecessor would not have authorized (broader scope, different context, or different peers).
  2. **Peer Trust Persistence:** A peer who was trusted by the predecessor becomes trusted by the successor. If the peer has drifted, or the successor's interactions with the peer differ, the inherited trust is stale.
  3. **Cross-Session Collusion:** A malicious principal operates through alternating sessions to build and exploit trust, with each session appearing individually within bounds while the aggregate exceeds the principal's authorization.

Recorded Elements

  1. **`session-trust-inheritance-receipt`:** For each trust inheritance, the exact trust inherited (which peer, what scope, what conditions), so inheritance is explicit.
  2. **`predecessor-session-conditions-signature`:** The conditions under which the predecessor earned the trust (context, mode, actions), so inheritance can be scoped.
  3. **`successor-session-divergence-receipt`:** The exact conditions in which the successor differs from the predecessor, so trust scoping can be adjusted.
  4. **`cross-session-aggregate-signature`:** The principal's aggregate behavior across its sessions, so cross-session patterns are visible.

Condition of Validity

* **Applies when:** Sessions inherit trust, trust affects downstream actions, and successors can differ from predecessors in ways that affect trust validity. * **Does not apply when:** Trust is session-scoped, trust is cryptographically bound to specific conditions, or successors are verified equivalent to predecessors.

Decision Boundary

  1. **Does the session inherit trust?** If no, session-scoped trust applies. If yes, proceed.
  2. **Do the `predecessor-session-conditions-signature` and `successor-session-divergence-receipt` show the successor differs?** If yes, inheritance must be scoped. If no, inheritance is direct.
  3. **Does `cross-session-aggregate-signature` show suspicious patterns?** If yes, cross-session collusion is suspected. If no, inheritance is legitimate.
  4. **Conversely, when can a session accept inherited trust without scoping?** Only when the successor's conditions are verified equivalent to the predecessor's, or the trust is explicitly scoped to the principal (not the session).

Operational Effect

  1. **Predecessor Misuse Prevention:** Trust is scoped to the conditions it was earned under.
  2. **Stale Trust Prevention:** Peer trust is verified current, not assumed inherited.
  3. **Cross-Session Integrity:** Aggregate behavior is tracked, catching collusion.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class TrustInheritanceVerdict(Enum):
    NO_INHERITANCE = auto()
    TRUST_SCOPED = auto()
    TRUST_ACCEPTED = auto()
    CROSS_SESSION_COLLUSION_SUSPECTED = auto()

@dataclass(frozen=True)
class SessionTrustInheritance:
    inheritance_id: str
    predecessor_conditions_hash: str
    successor_conditions_hash: str
    inherited_trust_scope: float  # 0-1
    cross_session_aggregate_deviation: float
    principal_acknowledgment: bool

@dataclass(frozen=True)
class InheritancePolicy:
    max_acceptable_aggregate_deviation: float

@dataclass(frozen=True)
class InheritanceManifest:
    verdict: TrustInheritanceVerdict
    directive: str
    manifest_digest: str

class CrossSessionTrustGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_inheritance(
        cls, inheritance: SessionTrustInheritance, policy: InheritancePolicy
    ) -> InheritanceManifest:
        
        # Gate 1: No inheritance
        if not inheritance.inheritance_id:
            digest = cls._hash(json.dumps({
                "inheritance": "NONE"
            }, sort_keys=True))
            return InheritanceManifest(
                verdict=TrustInheritanceVerdict.NO_INHERITANCE,
                directive=f"PROCEED: No trust inheritance.",
                manifest_digest=digest
            )

        # Gate 2: Cross-session collusion
        if inheritance.cross_session_aggregate_deviation > policy.max_acceptable_aggregate_deviation:
            return InheritanceManifest(
                verdict=TrustInheritanceVerdict.CROSS_SESSION_COLLUSION_SUSPECTED,
                directive=f"FLAG: Cross-session aggregate deviation {inheritance.cross_session_aggregate_deviation:.2f}.",
                manifest_digest=cls._hash(f"COLLUSION:{inheritance.inheritance_id}")
            )

        # Gate 3: Conditions match
        if inheritance.predecessor_conditions_hash == inheritance.successor_conditions_hash:
            digest = cls._hash(json.dumps({
                "inheritance": inheritance.inheritance_id,
                "type": "DIRECT"
            }, sort_keys=True))
            return InheritanceManifest(
                verdict=TrustInheritanceVerdict.TRUST_ACCEPTED,
                directive=f"PROCEED: Trust inheritance {inheritance.inheritance_id} direct (conditions match).",
                manifest_digest=digest
            )

        # Gate 4: Scoped inheritance
        digest = cls._hash(json.dumps({
            "inheritance": inheritance.inheritance_id,
            "pred_conditions": inheritance.predecessor_conditions_hash,
            "succ_conditions": inheritance.successor_conditions_hash,
            "scope": f"{inheritance.inherited_trust_scope:.3f}"
        }, sort_keys=True))
        
        return InheritanceManifest(
            verdict=TrustInheritanceVerdict.TRUST_SCOPED,
            directive=f"PROCEED_WITH_SCOPE: Trust inheritance {inheritance.inheritance_id} scoped to {inheritance.inherited_trust_scope:.2f}.",
            manifest_digest=digest
        )