01 / The operating case
What changes in a real workflow?
A child agent receives an API token for a short invoice task.
- 01Owner
- 02Agent + workload
- 03Task context
- 04Action decision
02 / Decision contract
What the executor must check
Issue a bounded token for the intended audience, store it outside prompt context, rotate on exposure and revoke it when work ends.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A long-lived shared token remains usable after the child task is cancelled.
Evidence to retain
Keep token identifier, issuance purpose, use, rotation, revocation and denied reuse without storing token bytes.
04 / Canonical scope
Why this reference stands alone
Machine identity lifecycle owns the principal; this page owns credential handling.
Technical artifact
Credential states for a ten-minute child task
issue token T for audience invoice-api at t0 child task closes at t0+7m → revoke T rotation event at t0+8m must not reopen task reuse at t0+9m → DENY
Run the denial test
Cancel the task before token expiry and invoke an allowed method. A token-only check will pass incorrectly; the task grant check must fail.
Primary references