CAIN-42 invariant · E28

E28-I1: portable identity does not imply portable authority

Held · CAIN-42 Evolution 28 -- Portable Machine Agency & Execution Identity

Last reviewed 2026-10-01

held   niche Policy, law & governance · family law

What this rule means

CAIN-42 must always satisfy: portable identity does not imply portable authority. It is one of 90 invariants checked for CAIN-42 Evolution 28 -- Portable Machine Agency & Execution Identity. An invariant is a rule the system may never break, whatever an agent or attacker does; the test suite tries to break it across many scenarios and records the result.

Recorded detail

{'identity': 'cid_0d6eac900de513c66dc4daab1ab79d1d', 'foreign': 'orga.example:cid_ad0c4bfdbc8820dc2c32fa17d06f748b', 'granted': [], 'refused': {'read': ['NO_FEDERATION_POLICY']}, 'delegation': '', 'reasons': ['NO_LOCAL_AUTHORITY'], 'authori

Verify it in your browser

Your browser downloads the bundle's SHA256SUMS manifest and the file(s) behind this page, hashes them with SHA-256 locally (WebCrypto), and compares. A match shows the record you are reading is the published one; it does not by itself prove who published it (see the signed claims registry and the bundle verifier for that).

Check it yourself

Browse the raw bundle · How to reproduce it · SHA-256 manifest

Related rules

• E28-I2: delegated authority never exceeds parent authority (16 dimensions)
• E28-I3: expired authority does not resurrect
• E28-I4: revoked identity does not regain authority through replay
• E28-I5: model substitution triggers explicit continuity evaluation
• E28-I6: runtime substitution triggers explicit continuity evaluation
• E28-I7: capability expansion does not occur through identity migration
• E28-I8: consensus does not create authorization
• E28-I9: confidence does not create authorization

all 90 · E28-I2 →