Delegation
Effective authority is the intersection of every link in the chain: effective = leaf ∩ act[0] ∩ … ∩ root. Attenuation is monotone — a hop can only remove authority — and there is no rule anywhere that puts a scope back.
The leaf’s own scope claim is the most dangerous field in this system. This screen shows what the server computed instead of believing it.
A committed measurement, not a live broker. BROKER_API_BASE_URL is unset, so all four screens render the artifacts committed under artifacts/ — written by one run of python -m agent_authz_broker.demo against real PostgreSQL. It executes every scenario under both policies, counts irreversible_effect rows from a clean database each time, and exports the audit_event rows it wrote, the approvals it left behind, and each delegation chain decoded from the token that was actually presented. Every number here was measured; none was typed. Attached to a running broker, these same screens show that database live.
- rootaliceholdsaccount:flagaccount:readlackscredit:issueauthority lost here
- leafagent-7holdsaccount:flagaccount:readcredit:issue
- effective (intersected)
- account:flagaccount:read
- required by the tool
- credit:issue
- attenuated away
- credit:issue
credit:issue is not in the effective set, so the call is refused with insufficient_effective_scope. The leaf claimed it; no amount of claiming puts back a scope an ancestor never had.