CAIN-42 invariant · E33

E33-AUTOPILOT-expand_authority: the autopilot may not expand_authority

Held · CAIN-42 Evolution 33 -- Governed Agentic Operating Fabric

Last reviewed 2026-10-01

held   niche Autonomy, control loops & recovery · family autopilot

What this rule means

CAIN-42 must always satisfy: the autopilot may not expand_authority. It is one of 581 invariants checked for CAIN-42 Evolution 33 -- Governed Agentic Operating Fabric. An invariant is a rule the system may never break, whatever an agent or attacker does; the test suite tries to break it across many scenarios and records the result.

Recorded detail

{'scenarios': 5, 'not_held': []}

Verify it in your browser

Your browser downloads the bundle's SHA256SUMS manifest and the file(s) behind this page, hashes them with SHA-256 locally (WebCrypto), and compares. A match shows the record you are reading is the published one; it does not by itself prove who published it (see the signed claims registry and the bundle verifier for that).

Check it yourself

Browse the raw bundle · How to reproduce it · SHA-256 manifest

Related rules

• E33-STATE-RECOVER_ADAPT: no state can be skipped after RECOVER_ADAPT
• E33-DEGRADED-verifier_unavailable: verifier_unavailable only removes routes
• E33-DEGRADED-evidence_unavailable: evidence_unavailable only removes routes
• E33-DEGRADED-trust_domain_unreachable: trust_domain_unreachable only removes routes
• E33-DEGRADED-policy_service_unavailable: policy_service_unavailable only removes routes
• E33-DEGRADED-world_state_stale: world_state_stale only removes routes
• E33-DEGRADED-revocation_service_unavailable: revocation_service_unavailable only removes routes
• E33-DEGRADED-cluster_partition: cluster_partition only removes routes

← E33-CONTRACTSTAGE-RECORD · all 581 · E33-AUTOPILOT-disable_controls →