Delegation
Effective authority is the intersection of every link in the chain: effective = leaf ∩ act[0] ∩ … ∩ root. Attenuation is monotone — a hop can only remove authority — and there is no rule anywhere that puts a scope back.
The leaf’s own scope claim is the most dangerous field in this system. This screen shows what the server computed instead of believing it.
A committed measurement, not a live broker. BROKER_API_BASE_URL is unset, so all four screens render the artifacts committed under artifacts/ — written by one run of python -m agent_authz_broker.demo against real PostgreSQL. It executes every scenario under both policies, counts irreversible_effect rows from a clean database each time, and exports the audit_event rows it wrote, the approvals it left behind, and each delegation chain decoded from the token that was actually presented. Every number here was measured; none was typed. Attached to a running broker, these same screens show that database live.
- rootaliceholdsaccount:flagaccount:readcredit:issue
- leafagent-7holdsaccount:readcredit:issue
- effective (intersected)
- account:readcredit:issue
- required by the tool
- credit:issue
- attenuated away
- nothing was removed
Authority survived the chain. If this scenario is refused, it is refused further on — at the audience check or at the approval check — and not here.