01 / The operating case
What changes in a real workflow?
A cloud coordinator delegates one warehouse read to an edge agent in another identity domain.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Exchange a bounded grant with issuer, audience, child workload, task, resource, expiry and parent reference; validate both domains before access.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
The edge runtime trusts a copied cloud bearer token with unrelated warehouse privileges.
Evidence to retain
Record domain mapping, parent/child grant IDs, audience validation and data access.
04 / Canonical scope
Why this reference stands alone
Delegation-graph validation checks lineage; this guide owns a handoff between identity domains.
Illustrative implementation artifact
Cross-domain handoff contract
origin signs bounded grant for child audience
receiving runtime authenticates child workload
receiver verifies issuer mapping, parent edge, expiry
child action is subset of delegated scope
executor rechecks current grant before effectPrimary references