{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-delegated-credential-exchange-from-silently-widening-authority-in-aaif-agent-chains",
  "title": "Which invariants prevent delegated credential exchange from silently widening authority in AAIF agent chains",
  "date_of_record": "2026 November 9",
  "scope": "Applies to AAIF delegated credential exchange where an agent presents a derived (delegated) credential to a downstream resource on behalf of a principal, across one or more delegation hops. Does not apply to root-credential direct presentation, nor to machine-to-machine flows that bypass AAIF delegation entirely.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-delegated-credential-exchange-from-silently-widening-authority-in-aaif-agent-chains.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-delegated-credential-exchange-from-silently-widening-authority-in-aaif-agent-chains.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-delegated-credential-exchange-from-silently-widening-authority-in-aaif-agent-chains.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1093,
    "python_slice_tokens": 230,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious boundary is between *identity continuity* and *authority continuity*. A delegated credential can be perfectly valid as an identity (the chain verifies, signatures check out, the subject is who it claims to be) while simultaneously representing an authority set that is a strict superset of the delegator's. AAIF's verification layer answers \"is...",
    "what_was_observed": "A three-hop chain was exercised: principal → orchestrator agent (hop 1) → retrieval sub-agent (hop 2) → tool-calling sub-agent (hop 3). Each hop requested a delegated credential with an explicit scope. The orchestrator's credential carried `{read:docs, read:index}`. The retrieval sub-agent, when constructing its request, merged its own *default* scope template (which contained `read:docs, read:index, write:cache`) ra...",
    "condition_of_validity": "The narrowing invariant holds only when the exchange layer enforces scope intersection at issuance time, using the *presented parent credential* as the ceiling — not the issuer's global policy. This requires: 1. The parent credential's scope set is parsed and carried into the issuance decision. 2. Requested child scopes are intersected against the parent set...",
    "decision_boundary": "Reject the exchange when `requested_scope ⊄ parent_scope`, when any scope token is non-canonical or contains an unexpanded wildcard, when the chain depth exceeds the configured maximum, or when the parent credential is absent from the request. Do not reject solely on issuer-policy mismatch — that is a different failure and conflates the two layers. Do not si...",
    "operational_effect": "Enforcing intersection-at-issuance converts a silent privilege-escalation class into a loud, attributable issuance failure at the exact hop where the widening was attempted. The failure is logged against the requesting agent and the parent credential, giving operators a precise locus. The cost is that agents with stale default templates fail fast instead of ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "f4ca2996fa79cf222f6681155b6bc27e206f8d6eff00f9f2301ebe68a29ffeb7",
    "verified_classes": [
      "ScopeWideningError"
    ],
    "verified_functions": [
      "intersect_scopes",
      "issue_delegated_credential"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "ScopeWideningError"
    ],
    "sample_fail_closed_invariants": [
      "delegated exchange requires a presented parent credential",
      "intersection is empty; refusing to issue a no-authority credential"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}