CAIN-42 invariant · E33

E33-KIND-delegate_capability: delegate_capability is executed only through E8

Held · CAIN-42 Evolution 33 -- Governed Agentic Operating Fabric

Last reviewed 2026-10-01

held   niche Identity, authority & delegation · family operation_kind

What this rule means

CAIN-42 must always satisfy: delegate_capability is executed only through E8. It is one of 581 invariants checked for CAIN-42 Evolution 33 -- Governed Agentic Operating Fabric. An invariant is a rule the system may never break, whatever an agent or attacker does; the test suite tries to break it across many scenarios and records the result.

Recorded detail

{'scenarios': 9, 'not_held': []}

Verify it in your browser

Your browser downloads the bundle's SHA256SUMS manifest and the file(s) behind this page, hashes them with SHA-256 locally (WebCrypto), and compares. A match shows the record you are reading is the published one; it does not by itself prove who published it (see the signed claims registry and the bundle verifier for that).

Check it yourself

Browse the raw bundle · How to reproduce it · SHA-256 manifest

Related rules

• E33-STATE-AUTHORIZE: no state can be skipped after AUTHORIZE
• E33-KIND-access_credential: access_credential is executed only through E8
• E33-KIND-create_capability: create_capability is routed to E29 AgentCapabilityMarketplace conformance
• E33-EVENT-capability_request: capability_request events chain and verify
• E33-EVENT-authorization_request: authorization_request events chain and verify
• E33-EVENT-delegation: delegation events chain and verify
• E33-EXHAUST-STOP: exhaustion mode STOP never increases authority
• E33-EXHAUST-REAUTHORIZE: exhaustion mode REAUTHORIZE never increases authority

← E33-KIND-create_subagent · all 581 · E33-KIND-modify_memory →