01 / The operating case
What changes in a real workflow?
An invoice child holds a payment tool credential but its parent grant permits only reconciliation.
- 01Origin grant
- 02Parent agent
- 03Narrow child grant
- 04Action boundary
02 / Decision contract
What the executor must check
Traverse the origin, parent and child grants; check issuer, audience, scope subset, task, expiry and revocation at the payment boundary.
03 / Failure and evidence
What goes wrong, and what can be proven?
A valid final credential conceals a missing or expired ancestor grant.
Retain validated edge IDs, policy version, denial reason and payment API outcome.
04 / Canonical scope
Why this reference stands alone
Multi-agent authorization covers the whole decision; this page specifies ancestor traversal and failure behavior.
Technical artifact
Validate one leaf action through three edges
origin O: invoice.match, invoice.release ≤ USD 10,000 parent P: invoice.match, invoice.release ≤ USD 5,000 child C: invoice.match only C requests invoice.release USD 4,000 result: DENY at C edge despite valid origin and parent
Run the denial test
Remove P from the grant store after C is issued. A validator that trusts only the leaf will allow; a complete validator denies because no valid path reaches O.
Primary references