{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-of-a-scoped-capability-token-fail-authorization-after-a-valid-delegation-chain-exceeds-its-attenuation-depth",
  "title": "Why does an instance of a scoped capability token fail authorization after a valid delegation chain exceeds its attenuation depth",
  "date_of_record": "2026 November 9",
  "scope": "Applies to AAIF-compliant capability tokens where a principal delegates a subset of its scope to a subordinate agent, which may delegate further, forming a chain whose effective authority is the intersection of all scopes along the path. Does not apply to flat bearer tokens, tokens without delegation metadata, or systems that enforce authorization solely at the resource server without chain verification.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-scoped-capability-token-fail-authorization-after-a-valid-delegation-chain-exceeds-its-attenuation-depth.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-scoped-capability-token-fail-authorization-after-a-valid-delegation-chain-exceeds-its-attenuation-depth.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-scoped-capability-token-fail-authorization-after-a-valid-delegation-chain-exceeds-its-attenuation-depth.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1316,
    "python_slice_tokens": 202,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The critical distinction is between **scope containment** (does the delegated scope lie within the parent's scope?) and **attenuation depth** (how many delegation hops the verification layer will traverse before rejecting the chain). A chain can be perfectly scope-contained at every hop and still fail authorization because the verifier enforces a maximum del...",
    "what_was_observed": "During interoperability testing between two AAIF verifiers (call them V1 and V2), a three-hop delegation chain was constructed: 1. Root principal `P` issues token `T0` to orchestrator `O` with scope `read:dataset/*`, `max_depth=3`. 2. `O` delegates to worker `W1` with scope `read:dataset/eu-*`, `max_depth=2` (attenuated). 3. `W1` delegates to worker `W2` with scope `read:dataset/eu-2024`, `max_depth=1`. Every hop is ...",
    "condition_of_validity": "The rejection behavior is valid (i.e., the chain *should* be rejected) only under the following conditions, all of which must hold: - The verifier's `max_depth` semantics are documented as **absolute chain length with strict inequality**, and the issuer's root token was minted with that same convention. If the issuer assumed \"remaining hops,\" the rejection i...",
    "decision_boundary": "The operational decision boundary is: **when the observed chain length equals the root token's `max_depth`, do not treat authorization success or failure as authoritative without inspecting the verifier's comparison operator.** Concretely: - If `len(chain) < root.max_depth` → authorize; no ambiguity. - If `len(chain) > root.max_depth` → reject; no ambiguity ...",
    "operational_effect": "The practical effect is that delegation chains sized to exactly the depth limit will pass in one environment and fail in another with identical token bytes, producing non-deterministic authorization across a federated deployment. Because the failure surfaces as a clean rejection rather than a partial authorization, it is easy to misattribute to scope or sign..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "248057729e738e4306b3719be344f9448d0b5f0147e0304194be25313b508cf8",
    "verified_classes": [
      "DelegationDepthAmbiguityError",
      "Hop"
    ],
    "verified_functions": [
      "effective_depth",
      "authorize"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "DelegationDepthAmbiguityError"
    ],
    "sample_fail_closed_invariants": [
      "empty chain has no root"
    ],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}