Decision
ADR 0007: Authority is resolved from immutable attenuating records
Keep identity, membership, context, capabilities, delegation, expiry, and revocation explicit and fail-closed.
Context
pre.action.v1 carries participant, acting identity, context-grant references, claimed authority, and caller-visible risk. None of those caller-supplied fields can be trusted as permission.
Decision
A trusted authority store admits immutable identity bindings, memberships, context grants, capabilities, and revocation records. The resolver reads only that admitted state.
Capabilities and context grants bind a subject to exact actions, targets, fields, risk ceilings, and time windows. Delegated children must attenuate every parent dimension. A child cannot widen action, target, field, risk, time, or delegation depth.
Revocation is a separate immutable record targeting a prior authority record. Revoking any ancestor invalidates its descendants without rewriting history.
Address syntax remains non-authoritative. Membership provides an addressable subject for explicit grants; a role name alone grants nothing.
The trusted boundary reclassifies risk. Caller riskClass and claimedAuthority are inputs to inspect, never decisions to accept.
Consequences
- possession of a capability address does not confer the capability;
- schema-valid authority records are not self-authorizing;
- field-level disclosure and action authority are first-class;
- delegation is monotonic attenuation rather than copied ambient privilege;
- revocation remains attributable and reconstructable;
- an authenticated authority store, not the action envelope, defines admitted authority state.