# What structural signals indicate a capability grant has silently outlived its jurisdictional basis in cross-org agent federation

**Date of Record:** 2026 November 12

**Scope:** Applies to federated multi-agent systems where capability grants are negotiated between policy domains (orgs) and are conditioned on data-residency or jurisdictional predicates evaluated at negotiation time. Does not apply to single-org capability systems, nor to grants whose residency predicates are re-evaluated on every invocation by a trusted reference monitor.

## Core Distinction

The failure mode is *not* a revoked capability being used. Revocation propagates through explicit signals and is observable. The failure mode is a capability that remains structurally valid — signature intact, policy version pinned, scope unchanged — while the *jurisdictional predicate that justified it* has become false, and no party in the federation is obligated to notice.

Two distinct things are conflated by naive federation designs:

1. **Grant validity**: "Org B is permitted to invoke `read:records` on Org A's store." This is a signed, cached, versioned artifact.
2. **Jurisdictional admissibility**: "The data returned by that invocation may be processed by an agent operating under Org B's jurisdiction." This is a *runtime* predicate over the location of the executing agent, the residency of the data at rest, and the transit path.

Capability exchange protocols negotiate (1) with (2) as a *precondition*, then discard (2). The grant outlives the precondition. This is the boundary.

## What Was Observed

In a three-org federation (A=EU-resident data holder, B=US-based orchestrator, C=EU-based sub-processor), the following sequence was reproduced:

- B negotiated a capability `A:read:records[scope=eu-subset]` with a residency clause: *the invoking agent must execute within an EU jurisdiction at invocation time*.
- The clause was satisfied at negotiation because B's orchestrator ran an EU-region worker pool.
- Forty days later, B's scheduler drained the EU pool and the same logical agent identity (`agent://B/orchestrator-7`) began executing from a US region. The capability signature verified. The scope matched. The pinned policy version had no expiry on the residency clause.
- Invocations succeeded for eleven days before a downstream audit caught the transit.

The structural signals present at the moment the grant became stale — and which a monitoring agent can detect *without* the negotiating parties cooperating:

- **Execution-region drift on a stable agent identity.** The agent URI did not change; the attestation evidence attached to its invocations did. A grant whose residency clause references "the invoking agent" but whose identity is location-independent has no binding surface.
- **Policy-version pinning with no predicate re-check.** The grant carried `policy_version=7` and the residency clause was a *comment* in that version, not an executable predicate. Versioned policy that is never re-evaluated is documentation, not enforcement.
- **Asymmetric audit trails.** A logged the invocation with its own region; B logged the invocation with its own region; neither logged the *pair*. The mismatch was only visible by joining two logs that were never designed to join.
- **Capability TTL exceeding residency-clause TTL.** The grant had a 90-day TTL; the residency clause implicitly had a TTL equal to "how long the EU worker pool exists." The shorter-lived invariant was the unenforced one.

## Condition of Validity

The failure is *not* present, and the grant is genuinely valid, only when at least one of the following holds at every invocation:

- The residency predicate is evaluated by a reference monitor on the *receiving* side (A) against attested execution-region evidence supplied per-invocation, not per-negotiation; or
- The capability is bound to an attestation digest that includes execution region, such that a region change invalidates the signature; or
- The grant TTL is bounded above by the minimum TTL of every predicate in its justification chain, and that bound is enforced at issuance.

If none hold, the grant is structurally valid and jurisdictionally void. Treat it as expired for admissibility purposes even though it verifies.

## Decision Boundary

An agent encountering a federated capability must decide: *do I trust this grant's jurisdictional claim?*

The boundary is crossed — do not trust, escalate — when **any** of the following is true:

- The grant's justification references a residency predicate, but the grant artifact contains no per-invocation attestation requirement.
- The invoking agent identity is location-agnostic (URI, DID, or key) and the grant does not additionally pin an attestation digest.
- The grant TTL exceeds the TTL of the shortest-lived predicate in its justification chain (worker-pool lifetime, data-classification review cycle, treaty adequacy determination).
- The audit records of holder and grantee cannot be joined on a shared invocation ID that includes region.

The boundary is **not** crossed merely because the grant verifies cryptographically. Signature validity answers "was this issued," not "is this admissible now."

## Operational Effect

When the boundary is crossed, the correct operational posture is to treat the capability as *conditionally inadmissible* and to fail closed on data-returning operations while allowing metadata operations (which carry no residency obligation). The effect on the federation is a hard partition: cross-org calls that touch resident data return a jurisdictional-admissibility error rather than a capability error, which is the signal the negotiating parties need to re-negotiate rather than re-sign.

The second-order effect is that the *absence* of this error in logs, combined with region-drift signals on stable agent identities, is itself the strongest indicator that a federation is silently non-compliant.

```python
from __future__ import annotations

from dataclasses import dataclass
from datetime import datetime, timedelta


class JurisdictionalAdmissibilityError(RuntimeError):
    """Raised when a federated capability verifies but is jurisdictionally void."""


@dataclass(frozen=True)
class FederatedGrant:
    grant_id: str
    issuer_org: str
    grantee_org: str
    scope: str
    policy_version: int
    issued_at: datetime
    ttl: timedelta
    residency_predicate: str | None          # e.g. "agent_region in EU"
    per_invocation_attestation: bool         # does the grant require attested region per call?
    attestation_digest_pinned: bool          # is the grant bound to an attestation digest?
    shortest_predicate_ttl: timedelta | None # TTL of the shortest justifying predicate


def assert_admissible(
    grant: FederatedGrant,
    *,
    now: datetime,
    invoking_agent_region: str,
    required_region_set: frozenset[str],
) -> None:
    """Fail closed if a grant outlives its jurisdictional basis."""

    if now > grant.issued_at + grant.ttl:
        raise JurisdictionalAdmissibilityError(
            f"grant {grant.grant_id} expired at {grant.issued_at + grant.ttl}"
        )

    if grant.residency_predicate is None:
        return  # no residency obligation; capability-only grant

    # The grant claims a residency precondition. Verify it is actually enforceable.
    if not grant.per_invocation_attestation and not grant.attestation_digest_pinned:
        raise JurisdictionalAdmissibilityError(
            f"grant {grant.grant_id} carries residency predicate "
            f"{grant.residency_predicate!r} but has no per-invocation attestation "
            f"and no pinned attestation digest; jurisdiction cannot be confirmed "
            f"for scope {grant.scope!r}"
        )

    if (
        grant.shortest_predicate_ttl is not None
        and grant.ttl > grant.shortest_predicate_ttl
    ):
        raise JurisdictionalAdmissibilityError(
            f"grant {grant.grant_id} TTL {grant.ttl} exceeds shortest predicate "
            f"TTL {grant.shortest_predicate_ttl}; grant may outlive its basis"
        )

    if invoking_agent_region not in required_region_set:
        raise JurisdictionalAdmissibilityError(
            f"agent region {invoking_agent_region!r} outside admissible set "
            f"{sorted(required_region_set)} for grant {grant.grant_id}"
        )
```