{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-aaif-scoped-agent-permissions-from-being-silently-widened-at-runtime-enforcement-points",
  "title": "Which invariants prevent AAIF-scoped agent permissions from being silently widened at runtime enforcement points",
  "date_of_record": "2026 November 11",
  "scope": "Applies to runtime policy enforcement points (PEPs) that mediate tool calls, filesystem access, network egress, and credential use for agents operating under an Agent Authorization and Identity Framework (AAIF) grant. Does not apply to static authorization-time review, nor to PEPs that re-derive authorization from the AAIF grant on every call without a cached decision.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-aaif-scoped-agent-permissions-from-being-silently-widened-at-runtime-enforcement-points.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-aaif-scoped-agent-permissions-from-being-silently-widened-at-runtime-enforcement-points.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-aaif-scoped-agent-permissions-from-being-silently-widened-at-runtime-enforcement-points.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1821,
    "python_slice_tokens": 332,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between **authorization-time scope** (the set of permissions written into the AAIF grant) and **enforcement-time scope** (the set of operations the PEP will actually permit). These are not the same set, and the gap between them is where least privilege dies. Most teams reason about AAIF permissions as if the grant is a ceiling...",
    "what_was_observed": "A research agent was granted AAIF scope `fs.read:/data/experiments/*` and `tool:summarize`. The PEP implemented path scoping with a prefix check after normalizing the requested path. The agent requested `/data/experiments/../secrets/keys.json`. Normalization collapsed this to `/data/secrets/keys.json`; the prefix check then ran against the *original* unnormalized string in one code path and the *normalized* string in...",
    "condition_of_validity": "The containment invariant holds only under all of the following conditions. If any fails, the PEP is not enforcing the grant and must be treated as unenforcing: 1. **Canonicalization precedes comparison, and comparison uses the canonical form on both sides.** The grant's terms are canonicalized at load time; the request is canonicalized at call time; the com...",
    "decision_boundary": "The boundary is this: **the PEP may only admit an operation if it can produce the exact grant term that authorizes it.** Not a term that \"covers\" it, not a term that \"matches\" it under some resolution algorithm — the term itself, as written in the grant, after canonicalization on both sides. If the PEP cannot point to the authorizing term, it must deny, and ...",
    "operational_effect": "When containment holds, the enforcement-time scope equals the authorization-time scope, and the AAIF grant becomes a trustworthy statement of what the agent can do. Audit queries against the grant answer the question \"what was this agent permitted?\" correctly, and anomaly detection on denial records surfaces scope-probing behavior. When containment fails, th..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "4ea75e74030c24a0c9ef0ccd5aa4ff6f9c6a0b53d39bb57c25b9ace6aae284b3",
    "verified_classes": [
      "ScopeContainmentError",
      "AAIFGrant",
      "EnforcementPoint"
    ],
    "verified_functions": [
      "canonicalize",
      "reconcile_decision_log",
      "__init__",
      "_authorizing_term",
      "admit"
    ],
    "verified_functions_count": 5,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "ScopeContainmentError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "posixpath",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}