Policy Through the Trajectory

Boundary definition

This stage keeps authorization current as a trajectory branches, reads memory, uses caches, delegates work, and resumes from checkpoints. Correlation can join calls into one trace. It cannot establish authority.

First response

For the failing branch, capture the protected receiver, principal and actor references, target audience, requested scope, credential validity, policy version, decision outcome, cache or memory scope, and checkpoint creation time. Redact credential material.

Symptom catalog

authority_in_trace_baggage: Correlation is mistaken for authority

Signal. A service trusts tenant, user, scope, or approval values copied through ordinary tracing metadata.

Confirm. Remove the verified credential while preserving trace baggage. If the call still succeeds, correlation is being mistaken for authority.

Correct. Validate authority through a trusted session, workload identity, scoped token, signed request, or equivalent channel. Keep trace context for correlation only.

upstream_permit_reused: An earlier permit becomes a transitive grant

Signal. A decision identifier from retrieval is accepted as permission for a memory read, connector call, or write.

Confirm. Change the downstream resource or operation while replaying the earlier permit.

Correct. Use the upstream event as evidence and require a current local decision at the protected receiver.

wrong_audience_delegation: Delegation targets the wrong receiver

Signal. One delegated credential works at multiple services or environments.

Confirm. Present a token intended for service A to service B in a controlled test.

Correct. Bind delegation to the target resource and narrow operation scope. Validate audience before payload processing.

stale_policy_resume: Checkpoint state outlives policy

Signal. Resumed work uses evidence or approvals that were valid when checkpointed but invalid now.

Confirm. Advance the policy version, expire identity, or revoke approval before resume.

Correct. Resolve current identity and policy, then reauthorize every protected saved artifact. Quarantine denied evidence and recompute dependent work.

memory_scope_crossing: Memory enters another authorization class

Signal. A preference, summary, or tool result appears in another user’s, tenant’s, or purpose’s context.

Confirm. Inspect memory ownership, authorization class, source references, purpose, and retention metadata.

Correct. Reject cross-scope reads before returning the payload. Partition storage or require an explicit current decision for reuse.

policy_version_untracked: The applied rule cannot be reconstructed

Signal. Two identical-looking requests receive different outcomes and the applied rule cannot be reconstructed.

Confirm. Check decision events for immutable policy and data-version references.

Correct. Record policy version, relevant resource version, reason code, and decision time on every protected step.

Diagnostic questions

1. Which fields are only correlation metadata, and which arrive through an integrity-protected authority channel?
2. Does every protected receiver validate its own target, scope, principal or actor, validity, and current policy?
3. Are memory and cache records scoped by principal, tenant, purpose, evidence provenance, and policy?
4. Does resume reauthorize saved plans, evidence, pending operations, and delegated work?
5. Can a decision be reproduced from references and a policy version without recovering a bearer token?

Exit criteria

• Correlation metadata is never accepted as authority.
• Every receiver records a current attributable decision.
• Delegation is bound to target, scope, actor, and lifetime.
• Memory, caches, and checkpoints are reauthorized before payload use.