Reading the matrix…
An agent can request an action. It cannot manufacture the authority to perform one.
Each row is one way a caller can be wrong. The naive baseline is the check ADR-001 predeclared before any code was written — signature and expiry only, the leaf’s scope claim taken at its word. It is a stated baseline for this comparison and not a claim about what any real product ships.
A committed measurement, not a live broker. BROKER_API_BASE_URL is unset, so all four screens render the artifacts committed under artifacts/ — written by one run of python -m agent_authz_broker.demo against real PostgreSQL. It executes every scenario under both policies, counts irreversible_effect rows from a clean database each time, and exports the audit_event rows it wrote, the approvals it left behind, and each delegation chain decoded from the token that was actually presented. Every number here was measured; none was typed. Attached to a running broker, these same screens show that database live.
resource server: http://localhost:8000/mcp
| Scenario | Naive baseline | Hardened | Irreversible effects |
|---|---|---|---|
| valid_requestCorrect audience, attenuated scope, matching approval The positive path. A suite that only proves refusals has shown a server that denies everything, which is easy. | allowed no refusal | allowed no refusal |
|
| wrong_audienceValid token, minted for another resource server Real signature, known issuer, unexpired, sufficient scope, approval on file. The only defect is who the token was minted for. | allowed no refusal | denied audience_mismatch Minted for a different resource server. This one is not its audience. |
|
| scope_amplificationDelegated token claims a scope its delegator never had alice holds read and flag. The leaf claims read, flag and credit:issue. Effective authority is the intersection down the chain, not the leaf's claim. | allowed no refusal | denied insufficient_effective_scope The scope survived by the whole delegation chain does not include what this tool needs. |
|
| no_approvalIrreversible tool with no recorded human approval Everything is correct except that no human ever approved this act. | denied approval_required No matching, unexpired, unconsumed approval exists in this server's database. | denied approval_required No matching, unexpired, unconsumed approval exists in this server's database. |
|
| expired_approvalAn approval that has expired A human approved this, two hours ago. An approval is not good forever. | denied approval_expired An approval was found and it is past its expiry. | denied approval_expired An approval was found and it is past its expiry. |
|
| approval_replayOne approval, two calls The same valid token and the same valid approval, presented twice. The approval is consumed by a conditional UPDATE, so the second call finds nothing to spend. | denied approval_required No matching, unexpired, unconsumed approval exists in this server's database. | denied approval_required No matching, unexpired, unconsumed approval exists in this server's database. |
|
| Across 6 scenarios | 4 irreversible effects | 2 irreversible effects | every count is a row in irreversible_effect |
The 2 effects the hardened server permitted were each required by the scenario that produced them: valid_request (1 of 1 allowed), approval_replay (1 of 1 allowed). Each needed credit:issue to survive the whole delegation chain and a matching, unexpired, unconsumed approval to exist in the server’s own database.