{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-capability-scoped-tool-invocation-from-degrading-into-ambient-authority-under-mid-execution-policy-reload",
  "title": "Which invariants prevent capability-scoped tool invocation from degrading into ambient authority under mid-execution policy reload",
  "date_of_record": "2026 November 9",
  "scope": "Applies to runtime enforcement layers that mediate tool/function invocation through capability tokens, where policy can be reloaded while a tool call is in flight. Does not apply to statically compiled policy (where the policy image is immutable for the process lifetime), nor to sandboxes that revoke the entire process on any policy change.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-capability-scoped-tool-invocation-from-degrading-into-ambient-authority-under-mid-execution-policy-reload.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-capability-scoped-tool-invocation-from-degrading-into-ambient-authority-under-mid-execution-policy-reload.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-capability-scoped-tool-invocation-from-degrading-into-ambient-authority-under-mid-execution-policy-reload.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1890,
    "python_slice_tokens": 368,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between **authority** (what a token *permits*) and **attenuation state** (what the currently loaded policy *admits*). A capability token is a bearer credential: possession implies the right to invoke. A runtime policy is a predicate evaluated at the mediation point. The failure mode is not \"policy is stale\" — that is expected ...",
    "what_was_observed": "In a mediation layer where each tool invocation carries a signed capability manifest (`{tool, resource, verb, constraints, gen}`) and the runtime holds a policy document mapping `(tool, resource, verb)` triples to allow/deny plus constraint predicates, the following sequence was reproducible: 1. Agent requests `fs.write` on `/data/out/report.csv` under generation 7. Manifest admits it; check passes. 2. Between the ad...",
    "condition_of_validity": "The failure requires all of the following to hold simultaneously: - Policy is reloadable at runtime (hot reload, SIGHUP, file-watch, or control-plane push). - The mediation point resolves scope *after* the admission decision, i.e., the check and the dispatch do not share a frozen snapshot of the policy. - The capability manifest does not pin a policy generat...",
    "decision_boundary": "The operational decision is: **at what point do you freeze the policy image for a given invocation?** Three viable postures, each with a distinct cost: 1. **Bind-at-check.** Snapshot the policy generation at the moment of admission; dispatch against that snapshot. Requires the runtime to hold the old generation alive until all in-flight calls complete (a ref...",
    "operational_effect": "When the monotone-attenuation invariant holds and constraint predicates are pure over the frozen snapshot, the reload window is harmless: in-flight calls complete under the generation they were admitted against, and new calls are evaluated against the new generation with the guarantee that their authority is a subset of what their manifests permit. The audit..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "39fc3f37c5b3f7d5381df7734e3aa9d292f210f953c5af1146faa067a30b8d2d",
    "verified_classes": [
      "PolicyGenerationError",
      "PolicySnapshot",
      "CapabilityManifest"
    ],
    "verified_functions": [
      "dispatch",
      "is_attenuation_of"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "PolicyGenerationError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}