{
  "schema_version": "1.3.0",
  "slug": "what-structural-signals-indicate-the-delegated-authority-scope-in-a2a-v1-0-agent-card-discovery-has-silently-exceeded-the-trust-boundary-at-cross-orga",
  "title": "What structural signals indicate the delegated authority scope in A2A v1.0 agent card discovery has silently exceeded the trust boundary at cross-organization federation time",
  "date_of_record": "2026 November 9",
  "scope": "Applies to Agent-to-Agent (A2A) v1.0 card resolution where a card is fetched across an organizational boundary (different trust domain, different `AgentCard.provider` authority, or a federated registry hop) and where any `Delegation` or `authorization` extension is present. Does not apply to intra-organization card discovery, nor to A2A v0.x cards lacking the `capabilities.extensions` block.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-the-delegated-authority-scope-in-a2a-v1-0-agent-card-discovery-has-silently-exceeded-the-trust-boundary-at-cross-orga.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-the-delegated-authority-scope-in-a2a-v1-0-agent-card-discovery-has-silently-exceeded-the-trust-boundary-at-cross-orga.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-the-delegated-authority-scope-in-a2a-v1-0-agent-card-discovery-has-silently-exceeded-the-trust-boundary-at-cross-orga.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1491,
    "python_slice_tokens": 353,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "There is a difference between *who may invoke* an agent and *what authority that invocation carries forward*. A2A v1.0 agent cards encode the former explicitly (`securitySchemes`, `security`, `defaultInputModes`) and the latter only by reference, through extension URIs that point at delegation semantics defined outside the card. At cross-organization discove...",
    "what_was_observed": "During a cross-org federation rollout, a consuming orchestrator resolved a partner agent card whose `capabilities.extensions` advertised a delegation extension with a `scope` array of OAuth-style scopes (`repo:write`, `billing:read`, `admin:impersonate`). The card was signed, the `provider.organization` matched the expected partner, and the extension URI resolved to a well-known spec. The orchestrator propagated the ...",
    "condition_of_validity": "The invariant holds — and the failure is reachable — when all of the following are true: 1. The card is fetched across a trust-domain boundary such that the fetching party's authority graph is disjoint from the origin's. 2. The card advertises a delegation extension with `delegation_chain_depth == 0` or an absent/empty `delegation_chain`. 3. The origin's aut...",
    "decision_boundary": "The boundary is between *scope advertisement* and *scope assertion*. A card may advertise any scope it wishes; the consuming side must treat advertised scopes as a **maximal candidate set**, never as an authorized set. The decision to request a scope must be made against the consumer's own policy, and the decision to honor a delegated chain must be made agai...",
    "operational_effect": "Treating the card as a grant inflates the effective authority of every federated caller to the union of advertised scopes, and the inflation is invisible in logs because the token exchange succeeds. The observable symptom is not an error but a *widening*: audit trails show the consumer requesting scopes it never needed, granted on a channel whose default was..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "4e9137d2d02fb725065262b3d16ac5ff5b1f3a125fab8750c20bac1a94b5a563",
    "verified_classes": [
      "DelegatedScopeBoundaryError",
      "DelegationExtension",
      "AgentCard"
    ],
    "verified_functions": [
      "resolve_delegated_scopes"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "DelegatedScopeBoundaryError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}