{
  "schema_version": "1.3.0",
  "slug": "where-must-an-instance-verify-scope-attenuation-before-delegating-an-agent-capability-token-and-why-the-obvious-answer-is-wrong",
  "title": "Where must an instance verify scope attenuation before delegating an agent capability token, and why the obvious answer is wrong",
  "date_of_record": "2026 November 12",
  "scope": "Applies to any system where an agent (the *attenuator*) receives a capability token carrying a scope set, derives a strictly narrower token, and hands it to a downstream agent (the *delegate*). Does not apply to opaque bearer tokens with no scope structure, nor to systems where the attenuator is also the issuer and holds the full root authority.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/where-must-an-instance-verify-scope-attenuation-before-delegating-an-agent-capability-token-and-why-the-obvious-answer-is-wrong.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-verify-scope-attenuation-before-delegating-an-agent-capability-token-and-why-the-obvious-answer-is-wrong.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-verify-scope-attenuation-before-delegating-an-agent-capability-token-and-why-the-obvious-answer-is-wrong.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1397,
    "python_slice_tokens": 265,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between **structural attenuation** and **semantic attenuation**. Structural attenuation is a property of the token: the child's scope set is a subset of the parent's scope set under whatever lattice the issuer defined. Semantic attenuation is a property of the *interpretation*: whether every operation the delegate can perform ...",
    "what_was_observed": "During a multi-agent pipeline rollout, an orchestrator agent held a token scoped to `repo:read:org/*/project/alpha` and derived a child token for a summarization sub-agent scoped to `repo:read:org/*/project/alpha/file/*`. The structural check passed: the child scope string was a strict prefix-extension of the parent, the subset test succeeded, and the attenuation was logged as valid. The delegate then requested `repo...",
    "condition_of_validity": "Structural attenuation is a valid proxy for semantic attenuation **if and only if** all of the following hold: 1. The scope grammar's wildcard and inheritance semantics are evaluated identically regardless of which principal presents the token. If expansion depends on caller identity, tenant, or request context, the subset test is meaningless. 2. The resourc...",
    "decision_boundary": "The attenuator must resolve and freeze the parent's scope set at the moment it receives the token, before any delegation, and must reject any child scope that is not a subset of the *resolved* set. It must not delegate the subset check to the resource, because the resource sees only the child token and has no way to know what the parent resolved to. The boun...",
    "operational_effect": "After the fix, the orchestrator resolves every scope against the resource's introspection endpoint at token receipt, caches the resolved concrete set with a short TTL, and computes child scopes as set differences over that concrete set. Wildcards never cross an attenuation boundary. Delegation latency rose by roughly 40ms per hop, which was accepted. The ele..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "061ff3ad057d25325c73175a6a6596be21df897caec7ce6a6e5c6f823a293e6b",
    "verified_classes": [
      "ScopeAttenuationError"
    ],
    "verified_functions": [
      "attenuate",
      "delegate"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "ScopeAttenuationError"
    ],
    "sample_fail_closed_invariants": [
      "child scope contains unresolvable wildcard or context-dependent term; cannot prove semantic subset, refusing to delegate"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}