CAIN-42 CAIN StudioCCAS · Module 4 of 5 · 15 min
Capability tokens and delegation that only shrinks
Standing credentials are the agent's biggest liability: anything holding them can do anything they allow, at any time. CAIN replaces them per action with capability tokens: signed, short-lived (30 s by default), carrying a nonce, and single-use at the MCPGate boundary.
When agents delegate to other agents, authority must attenuate monotonically: each hop keeps or narrows scope and limits, never widens them. Identity and authority travel with the request so the last hop can still answer 'who authorized this?'.
Review questions: can a token be replayed? Can a sub-agent ask for more than its parent held? Is the original principal visible at the final tool call?
Key points
- Per-action tokens instead of standing secrets.
- 30-second default lifetime, nonce, single use.
- Delegation only narrows authority.
- The original principal is visible at every hop.
In the CAIN-42 codebase
platform-gateway/cain_trust_kernel.py— ActionCapabilityTokencain/mcp_proxy.py— single-use token enforcement at the boundaryplatform-gateway/security_context.py— security-context continuity across boundaries (Moat #2)
Practice check
Practice 1 · choose one
A capability token replayed a second time is…
Practice 2 · true or false