Humans, organizations and agents — one chain of authority, signed at every link, verifiable by anyone.
Grants expire. There is no permanent authority in this system.
Worked examples of the verification sequence, timings authored. Switch examples above — the denial states are rendered with the same care as the success state.
A grant can never exceed its parent. Authority narrows down the chain and never widens.
There is no permanent grant. Every credential in the system carries an expiry it cannot outlive.
Revoking a link revokes everything beneath it. No sweep, no cache to wait out.
Four objects, three invariants, and the delegation chain drawn end to end.
Wire format, scope registry, standards position. Versioned from the first commit.
What a leaked credential reaches, for how long, and where authority ends by construction.
