{
  "schema_version": "1.3.0",
  "slug": "when-does-inherited-role-scoping-widen-privilege-instead-of-narrowing-it",
  "title": "When does inherited role scoping widen privilege instead of narrowing it?",
  "date_of_record": "2026 November 1",
  "scope": "Applies to role models where a parent scope (organization, project, tenant) defines a boundary and child roles define permissions within it. Excludes flat permission lists with no inheritance.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-does-inherited-role-scoping-widen-privilege-instead-of-narrowing-it.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-does-inherited-role-scoping-widen-privilege-instead-of-narrowing-it.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-does-inherited-role-scoping-widen-privilege-instead-of-narrowing-it.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 834,
    "python_slice_tokens": 122,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "**Predicate.** Inheritance narrows privilege if the effective permission set is the intersection of the child's grants with the parent's boundary. Inheritance widens privilege if the effective set is the union. A model that documents intersection but implements union grants access outside the parent boundary whenever a child role carries a permission the par...",
    "what_was_observed": "**Signature.** A user able to act outside the scope their visible grant should allow. The grant list looks correct at every level. The effective permission set, when computed, contains entries no single grant would produce. **Trace.** Organization role: read. Project role: read plus write. Union semantics produce read plus write at organization scope, so the user can write to every project in the organization. Inters...",
    "condition_of_validity": "Narrowing inheritance holds only while at least one holds: 1. **Intersection.** Effective permissions are computed as the intersection of child grants with the parent boundary, not the union. 2. **No widening grants.** Child roles are constrained to permissions the parent already holds, so union and intersection coincide. 3. **Explicit scope.** Every permiss...",
    "decision_boundary": "- Intersection semantics: inheritance narrows, safe. - Union with child grants constrained to the parent's set: safe today, breaks when a new child permission is added. - Union with unconstrained child grants: privilege widens at every scope boundary. - Explicit per-permission scope: safe regardless of combination rule, at the cost of managing scope per gran...",
    "operational_effect": "The defect lives in the combination rule, which is written once and read by no one, while roles are added continuously by people who assume narrowing. Remediation is to make the combination rule structural rather than conventional. The trap is to audit roles instead of the rule. The audit finds no bad grant because every grant is fine, and the widening persi..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "6d363789d5710c138f04cdc1f6c3ef5fb0b777347193db73b05b7b271d38f5af",
    "verified_classes": [
      "PrivilegeWideningError",
      "RoleLatticeGate"
    ],
    "verified_functions": [
      "dispatch_effective_permissions",
      "verify"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "PrivilegeWideningError"
    ],
    "sample_fail_closed_invariants": [
      "union semantics with child grants outside the parent set widen privilege"
    ],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}