Delegation tokens fail closed
An agent acting on someone's behalf carries a signed, short-lived
delegation token naming who is acting, for whom, and over which
compartments. The vault refuses any token it cannot fully verify —
tampering, expiry, or an unknown signer deny access outright rather
than degrade it.
A valid delegation token round-trips intact
- Given a delegation signed for a two-link acting chain
- When the vault verifies the token
- Then the verified claims match what was signed
A tampered token is refused
- Given a delegation signed for a two-link acting chain
- When the token payload is tampered with
- Then verification refuses the token
An expired token is refused
- Given a delegation that expired a minute ago
- Then verification refuses the token
A token from an unknown signer is refused
- Given a delegation signed with a key the vault does not trust
- Then verification refuses the token