01 / The operating case
What changes in a real workflow?
A parent sends an incident investigation task to a child that later isolates a host.
- 01Origin grant
- 02Parent agent
- 03Narrow child grant
- 04Action boundary
02 / Decision contract
What the executor must check
Issue an immutable edge receipt with issuer, subject, parent, scope, purpose, expiry and revocation pointer.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
Audit logs show only the child action with no proof of where its right came from.
Evidence to retain
Link edge receipt to final decision, executor attempt and host state.
04 / Canonical scope
Why this reference stands alone
Decision receipts record an action-time result; delegation receipts record handoff provenance.
Technical artifact
One receipt per authority edge
receipt R1: O → A, task T, invoice.read receipt R2: A → B, task T, invoice.read(I42) action decision D references R1 and R2 execution E references D receipt alone does not prove E occurred
Run the denial test
Delete R1 after R2 is issued. Chain validation must fail; a leaf receipt with a parent ID is not sufficient without its valid parent.
Primary references