01 / The operating case
What changes in a real workflow?
A child agent is denied a refund despite holding a valid service token.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Resolve originating owner, parent and child grants, each scope intersection, revocation, budget, resource policy and current task; report the first failed constraint.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
Debugging stops at “token valid” and misses a revoked ancestor.
Evidence to retain
Keep sanitized chain trace with edge IDs, policy version, failed predicate and protected executor outcome.
04 / Canonical scope
Why this reference stands alone
Delegation validation defines algorithm; this guide owns operator diagnosis.
Illustrative implementation artifact
Denial trace order
identity -> origin grant -> parent edges -> child scope
-> task active -> resource policy -> budget -> approval
-> current context -> final verdict
report first failing constraint with safe reason codePrimary references