{
  "schema_version": "1.3.0",
  "slug": "what-structural-signals-indicate-aaif-agent-identity-attestation-is-being-satisfied-by-a-delegated-credential-rather-than-the-workload-s-own-hardware",
  "title": "What structural signals indicate AAIF agent identity attestation is being satisfied by a delegated credential rather than the workload's own hardware-backed key",
  "date_of_record": "2026 November 14",
  "scope": "Applies to AAIF (Agent Identity Attestation Framework) verification paths where a workload presents a delegation chain rooted in a hardware-backed workload credential (TPM-backed key, Secure Enclave, or confidential-compute attestation report). Does not apply to pure bearer-token or mTLS-without-attestation deployments, nor to chains where the root is a human principal.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-aaif-agent-identity-attestation-is-being-satisfied-by-a-delegated-credential-rather-than-the-workload-s-own-hardware.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-aaif-agent-identity-attestation-is-being-satisfied-by-a-delegated-credential-rather-than-the-workload-s-own-hardware.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-aaif-agent-identity-attestation-is-being-satisfied-by-a-delegated-credential-rather-than-the-workload-s-own-hardware.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1499,
    "python_slice_tokens": 292,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The verifier's job is not \"is this chain valid\" but \"does the *presenting workload* hold the private key that the chain terminates in.\" A valid delegation chain proves that *some* attested identity authorized *some* set of capabilities; it does not prove that the process on the other end of the socket is the identity that was attested. These are routinely co...",
    "what_was_observed": "In a multi-hop deployment (orchestrator → task-runner → sub-agent), the following structural signals reliably distinguished \"leaf genuinely holds a hardware-backed key\" from \"leaf is riding the root's attestation\": 1. **Attestation report freshness vs. leaf key age.** The root attestation quote carried a nonce and timestamp from workload startup. The leaf's proof-of-possession signature was produced by a key whose fi...",
    "condition_of_validity": "These signals are diagnostic only when: (a) the verifier has access to the raw attestation quote and can parse nonce/`report_data` bindings, not just a boolean \"attestation valid\"; (b) leaf key-registration events are observable or the leaf key has an attestation certificate that can be inspected; (c) the delegation token format exposes per-hop claims rather...",
    "decision_boundary": "Treat the chain as **hardware-satisfied at the leaf** only if all hold: the verifier's nonce is present in the hardware-rooted element's bound data; a key-attestation statement binds the leaf public key to a hardware measurement; the leaf key's creation is covered by (not later than) the root attestation; and any `hardware_bound` claim at depth ≥ 1 is backed...",
    "operational_effect": "Downstream authorization that keys off \"hardware-attested\" (e.g., access to sealed secrets, privileged tool invocation, cross-tenant data) will over-grant to software-key leaves. The blast radius equals the union of capabilities delegated to any leaf, because a compromised leaf key is indistinguishable from a legitimate one under chain-only verification. Mit..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "086d991a806d1aceaaac83b97c0e23bd707329b7ee0082bfaa87d7af5a770a3b",
    "verified_classes": [
      "AttestationBindingError",
      "ChainEvidence"
    ],
    "verified_functions": [
      "assert_leaf_hardware_bound",
      "classify"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "AttestationBindingError"
    ],
    "sample_fail_closed_invariants": [
      "verifier nonce is not bound into the hardware-rooted element; leaf proof-of-possession is decoupled from the root quote",
      "leaf presents no key-attestation statement; chain is satisfiable with a software key and cannot inherit root assurance",
      "delegator asserts hardware_bound at depth >= 1 with no per-hop key-attestation; treating as delegation-only"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}