Delegation
Effective authority is the intersection of every link in the chain: effective = leaf ∩ act[0] ∩ … ∩ root. Attenuation is monotone — a hop can only remove authority — and there is no rule anywhere that puts a scope back.
The leaf’s own scope claim is the most dangerous field in this system. This screen shows what the server computed instead of believing it.
A committed measurement, not a live broker. BROKER_API_BASE_URL is unset, so all four screens render the artifacts committed under artifacts/ — written by one run of python -m agent_authz_broker.demo against real PostgreSQL. It executes every scenario under both policies, counts irreversible_effect rows from a clean database each time, and exports the audit_event rows it wrote, the approvals it left behind, and each delegation chain decoded from the token that was actually presented. Every number here was measured; none was typed. Attached to a running broker, these same screens show that database live.
No delegation. This token was issued directly to its subject, so the chain is one link and the intersection is that link’s own scopes. The attenuation rule still runs; it just has nothing to take away.
- leafagent-7holdsaccount:readcredit:issue
- effective (intersected)
- account:readcredit:issue
- required by the tool
- credit:issue
- attenuated away
- nothing was removed
Authority survived the chain. If this scenario is refused, it is refused further on — at the audience check or at the approval check — and not here.