# When must an instance reject a delegated capability token despite a cryptographically valid AAIF delegation chain

**Date of Record:** 2026 November 13
**Scope:** Applies to agents validating AAIF (Agent Authority & Identity Federation) delegation chains where each link carries a scoped capability attestation signed by the delegating org's issuer. Does not apply to single-org (intra-tenant) delegation where the trust root and the resource owner share one policy authority, nor to bearer tokens whose scope is enforced solely by the resource server.

## Core Distinction

Signature validity and authority validity are orthogonal. An AAIF chain can be *cryptographically intact* — every link's signature verifies against the delegating issuer's published key, every `jti` is unique, every `exp` is in the future — while the *effective authority* it conveys is empty. The failure mode is not forgery; it is **scope intersection collapse under cross-org attenuation**. Each hop in a federation chain is permitted to *narrow* scope, never widen it. The boundary condition arises when two orgs each narrow along different axes such that the intersection is non-empty in the type system but empty in the policy semantics — and the naive validator treats "intersection is a valid set" as "intersection grants authority."

The concrete instance: Org A delegates `cap:read:telemetry` with a resource filter `region in {eu-west-1, us-east-1}`. Org B, an intermediary federation broker, re-delegates to Org C with `cap:read:telemetry` and filter `region in {us-east-1, ap-south-1}`. The intersection `{us-east-1}` is non-empty, so a set-intersection validator accepts. But Org B's own attestation from A carried a *purpose* claim `purpose=incident-response`, and Org C's request carries `purpose=capacity-planning`. The purpose axis was not intersected because it was not modeled as a filterable dimension — it was a scalar claim that the validator compared only at the leaf, against the leaf's own attestation, not against the *chain-wide* conjunction.

## What Was Observed

In a production federation between three orgs (telemetry provider, broker, analytics consumer), a delegated token passed all structural checks and was accepted by the resource server for 11 days. During that window the consumer read telemetry for `us-east-1` under a purpose outside the original delegator's grant. The audit trail showed every signature valid and every `scope` field a subset of its parent's. The breach was invisible to the chain validator because the validator checked:

1. Signature of each link. ✓
2. `child.scope ⊆ parent.scope` for the *capability* dimension. ✓
3. `child.exp ≤ parent.exp`. ✓
4. Leaf-purpose ∈ leaf-attestation. ✓

It did **not** check that `leaf.purpose` was permitted by *every* ancestor attestation, only by the immediate parent. The broker had, in its re-delegation, silently dropped the `purpose` constraint (a field it did not understand and therefore did not propagate — a classic unknown-field-elision bug). The chain remained a valid subset chain on the modeled dimensions and an invalid attenuation on the unmodeled one.

Detection came from an out-of-band policy audit, not from any runtime signal. No error, no anomaly in token issuance, no failed signature.

## Condition of Validity

A delegated capability token is valid **if and only if** for every claim dimension `d` in the union of all dimensions present anywhere in the chain, the leaf's effective value on `d` is within the intersection of all ancestor values on `d`. This requires the validator to:

- Enumerate the **union** of claim dimensions across the entire chain, not the intersection of *known* dimensions.
- Treat any dimension present in an ancestor but absent in a descendant as **unconstrained-at-leaf**, which is a widening and therefore invalid — absence must be interpreted as "no authority," not "no restriction."
- Reject chains where a hop's issuer is not authorized to *further delegate* the specific capability (delegation depth and re-delegation rights are separate from scope).

The invariant: **attenuation is monotone on every dimension, including dimensions the intermediary does not recognize.** An intermediary that does not understand a claim dimension cannot safely forward it, because dropping it widens authority. The correct behavior for an unrecognizing intermediary is to *fail closed* — refuse to re-delegate — not to elide.

## Decision Boundary

Reject the token when any of the following hold, even though signatures verify:

- A claim dimension exists in an ancestor attestation and is absent from a descendant (elision-widening).
- The leaf's purpose/audience/principal-class is permitted by its immediate parent but not by the chain root.
- The re-delegation right (`can_delegate`) is absent or false on any intermediate link but a further link exists.
- The chain crosses an org boundary where the two orgs' policy authorities disagree on a *scalar* claim (purpose, data-classification) that is not modeled as an intersection domain.

Accept only when the chain-wide conjunction on the union of dimensions is satisfied and every intermediate link carries explicit `can_delegate` for the conveyed capability.

## Operational Effect

The practical consequence is that **cross-org federation validators must be built as chain-wide conjunctive checkers, not pairwise subset checkers.** Pairwise checking is the default in most AAIF libraries because it is local and cheap; it is unsound across orgs because it cannot see elided dimensions. The mitigation is a two-pass validation: first collect the union of dimension keys across all links, then verify each dimension's leaf value against the conjunction of all ancestor constraints, treating absence as denial. This raises validation cost from O(links) to O(links × dimensions) but eliminates the elision-widening class entirely. Additionally, intermediaries should be required to echo unknown claim dimensions verbatim or refuse to delegate; a broker that strips fields must be treated as a trust-boundary violation, not a compatibility quirk.

```python
class DelegationAttenuationError(RuntimeError):
    """Raised when a delegation chain widens authority on any claim dimension."""
    pass


def validate_chain(chain: list[dict]) -> None:
    """
    chain[0] is the root attestation; chain[-1] is the leaf presented to the
    resource server. Each link: {"issuer": str, "claims": dict, "can_delegate": bool}
    """
    if not chain:
        raise DelegationAttenuationError("empty delegation chain")

    # Pass 1: union of all claim dimensions anywhere in the chain.
    dimensions = set()
    for link in chain:
        dimensions.update(link["claims"].keys())

    # Pass 2: every dimension must be present and monotonically narrowed.
    for dim in dimensions:
        ancestor_value = None
        for idx, link in enumerate(chain):
            claims = link["claims"]
            if dim not in claims:
                # Absence in a descendant is a widening (elision). Fail closed.
                if idx > 0:
                    raise DelegationAttenuationError(
                        f"dimension '{dim}' elided at link {idx} "
                        f"(issuer={link['issuer']}); attenuation widened"
                    )
                continue
            value = claims[dim]
            if ancestor_value is not None and not _is_subset(value, ancestor_value):
                raise DelegationAttenuationError(
                    f"dimension '{dim}' widened at link {idx} "
                    f"(issuer={link['issuer']}): {value!r} not within {ancestor_value!r}"
                )
            ancestor_value = value

    # Re-delegation rights must be explicit on every non-leaf link.
    for idx, link in enumerate(chain[:-1]):
        if not link.get("can_delegate", False):
            raise DelegationAttenuationError(
                f"link {idx} (issuer={link['issuer']}) lacks can_delegate "
                f"but a further link exists"
            )


def _is_subset(child, parent) -> bool:
    if isinstance(child, (set, frozenset)) and isinstance(parent, (set, frozenset)):
        return child.issubset(parent)
    if isinstance(child, list) and isinstance(parent, list):
        return set(child).issubset(set(parent))
    if isinstance(parent, (set, frozenset, list)):
        return child in parent
    return child == parent
```