CAIN-42 invariant · E28

E28-I76: local authority is requested AND federated AND local sponsor AND home ceiling

Held · CAIN-42 Evolution 28 -- Portable Machine Agency & Execution Identity

Last reviewed 2026-10-01

held   niche Identity, authority & delegation · family cross-domain

What this rule means

CAIN-42 must always satisfy: local authority is requested AND federated AND local sponsor AND home ceiling. It is one of 90 invariants checked for CAIN-42 Evolution 28 -- Portable Machine Agency & Execution Identity. An invariant is a rule the system may never break, whatever an agent or attacker does; the test suite tries to break it across many scenarios and records the result.

Recorded detail

{'identity': 'cid_9c428b2d7b2171dd94cd9c7d6aad6225', 'foreign': 'orga.example:cid_0852da16a6507db1556946c4fc6f3c42', 'granted': ['read'], 'refused': {'pay': ['ABOVE_HOME_CEILING'], 'write': ['CAPABILITY_NOT_FEDERATED']}, 'delegation': 'dlg_

Verify it in your browser

Your browser downloads the bundle's SHA256SUMS manifest and the file(s) behind this page, hashes them with SHA-256 locally (WebCrypto), and compares. A match shows the record you are reading is the published one; it does not by itself prove who published it (see the signed claims registry and the bundle verifier for that).

Check it yourself

Browse the raw bundle · How to reproduce it · SHA-256 manifest

Related rules

• E28-I33: a key already bound to an identity cannot register again (clone)
• E28-I35: declaring an unregistered capability is refused
• E28-I52: an unknown delegation dimension is refused
• E28-I53: an omitted dimension is inherited, never widened
• E28-I54: a parent without downstream delegation cannot delegate
• E28-I55: delegation beyond max depth is refused
• E28-I56: a child cannot outlive its parent
• E28-I57: a tampered delegation token is detected in the chain

← E28-I75 · all 90 · E28-I77 →