01 / The operating case
What changes in a real workflow?
A child presents a signed grant from an unknown issuer to delete a production resource.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Validate algorithm, key binding, issuer allowlist, audience, time and canonical payload; then verify issuer was entitled to delegate the exact right.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A valid signature from an untrusted key is mistaken for organizational permission.
Evidence to retain
Record key ID, validation steps, issuer entitlement result and denial; never log private key material.
04 / Canonical scope
Why this reference stands alone
Delegation-graph validation owns ancestry; this page owns artifact integrity and issuer verification.
Illustrative implementation artifact
Signature validation order
parse bounded payload -> select trusted issuer key
verify signature and canonical bytes
validate audience, subject, issue and expiry time
verify issuer entitlement to delegate exact scope
check parent and revocationPrimary references