01 / The operating case
What changes in a real workflow?
A reconciliation child presents a payment operation whose parent could only read invoices.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Traverse to an accountable origin, reject cycles and missing parents, verify each issuer and expiration, intersect scopes and apply current revocations before the final action check.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A policy engine checks only the leaf grant and misses a revoked or read-only ancestor.
Evidence to retain
Record validated edge IDs, failed subset test and final denial without exposing unrelated grants.
04 / Canonical scope
Why this reference stands alone
Grant representation defines one node; this guide validates the complete ancestry.
Illustrative implementation artifact
Graph validation invariants
seen = set()
for grant in path(leaf, origin):
reject if grant.id in seen
reject if grant.revoked or grant.expired
reject if child.scope is not subset of parent.scope
seen.add(grant.id)
reject unless origin is accountablePrimary references