{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-fail-delegated-credential-validation-when-an-aaif-trust-chain-crosses-an-issuer-boundary-mid-scope",
  "title": "Why does an instance fail delegated credential validation when an AAIF trust chain crosses an issuer boundary mid-scope",
  "date_of_record": "2026 November 12",
  "scope": "Applies to AAIF-compliant delegated credential chains where an agent instance obtains a scoped token from issuer A and presents it to resource server B whose trust anchor differs from A's, and where the delegation scope is narrowed at each hop. Does not apply to single-issuer deployments, to opaque bearer tokens without a verifiable chain, or to cases where all issuers share a single root trust anchor and a common scope vocabulary.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-fail-delegated-credential-validation-when-an-aaif-trust-chain-crosses-an-issuer-boundary-mid-scope.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-fail-delegated-credential-validation-when-an-aaif-trust-chain-crosses-an-issuer-boundary-mid-scope.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-fail-delegated-credential-validation-when-an-aaif-trust-chain-crosses-an-issuer-boundary-mid-scope.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1690,
    "python_slice_tokens": 325,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between **scope intersection** and **trust-chain intersection**. AAIF requires that a delegated credential's effective scope be the intersection of every delegation hop's granted scope. It separately requires that the credential's issuer chain terminate at a trust anchor the verifier recognizes. These are two independent latti...",
    "what_was_observed": "An agent instance `agent-7f3` held a root credential issued by `issuer-alpha` (scope: `read:dataset/*`, `write:dataset/staging`). It delegated a narrowed credential to a sub-agent via `issuer-beta`, which is federated with `issuer-alpha` for `read:*` scopes only. The sub-agent presented the credential to resource server `rs-gamma`, whose trust anchor is `issuer-alpha` directly and which does *not* list `issuer-beta` ...",
    "condition_of_validity": "The invariant that must hold for cross-issuer delegation to be safe: > For every delegation hop *h* from issuer *I_h* to issuer *I_{h+1}*, the verifier must confirm that *I_{h+1}* is authorized by *I_h* to issue narrowed credentials for the scopes in *h*'s granted set, **before** that hop's narrowing is applied to the effective scope. Equivalently: scope int...",
    "decision_boundary": "The operational decision boundary is: **at which hop does the verifier stop trusting narrowing?** Three viable policies exist, and the choice must be explicit: 1. **Strict contiguous trust** — require every edge to be an authorized-delegation edge from the verifier's anchor. Reject the credential if any edge fails. Safest; breaks legitimate multi-federation ...",
    "operational_effect": "Under policy 1, federated agents fail closed but lose cross-org delegation entirely — every resource server must anchor every issuer it will ever see. Under policy 2, agents retain read access narrowed by trusted hops and lose any capability narrowed only by untrusted intermediaries, which is the intended security posture but surprises operators who expect \"..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "c183fa6f82daf86bedf5d00618e79636aa74cfb1f8ae83088e940d96307f8425",
    "verified_classes": [
      "TrustChainTruncationError",
      "Hop"
    ],
    "verified_functions": [
      "effective_scope",
      "authorize_request"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "TrustChainTruncationError"
    ],
    "sample_fail_closed_invariants": [
      "empty delegation chain"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}