CAIN-42 invariant · E37

authority_algebra: every 'authority algebra' invariant in this bundle (9 of 9 held)

Held · CAIN-42 Evolution 37 -- Autonomous Execution Mesh

Last reviewed 2026-10-01

held   niche Identity, authority & delegation · family authority_algebra

What this rule means

CAIN-42 must always satisfy: every 'authority algebra' invariant in this bundle (9 of 9 held). It is one of 27 invariants checked for CAIN-42 Evolution 37 -- Autonomous Execution Mesh. An invariant is a rule the system may never break, whatever an agent or attacker does; the test suite tries to break it across many scenarios and records the result.

Recorded detail

{
 "held": 9,
 "total": 9
}

Products this protects

• CAIN Agent Hosting — Host your agents on CAIN, governed by default.
• CAIN Agent Runtime — A runtime where every agent action passes through CAIN.
• CAIN Autonomous DevOps — Let agents run deployments, with every change checked and reversible.
• CAIN Compute Governance — Limits on how much compute an agent may use, and for what.
• CAIN Edge — CAIN decisions on devices at the edge, close to where agents act.
• CAIN Execution Conformance — Proves an action ran exactly the way it was approved.
• CAIN Execution Mesh — A network of governed places where agent actions run.
• CAIN Execution Observatory — One view of every agent action across many systems.
• CAIN Execution Proof — Proof of what an action actually did, not just what was asked.
• CAIN Governance BOM — A bill of materials listing every model, tool and rule an agent depends on.
• CAIN Governance Sidecar — A sidecar container that governs an agent without code changes.
• CAIN Mobility — Governance for agents that drive, fly or move things.
• CAIN Recovery — Undo and recover safely after an agent mistake.
• CAIN Runtime Passport — A passport issued at runtime for each agent session.

Verify it in your browser

Your browser downloads the bundle's SHA256SUMS manifest and the file(s) behind this page, hashes them with SHA-256 locally (WebCrypto), and compares. A match shows the record you are reading is the published one; it does not by itself prove who published it (see the signed claims registry and the bundle verifier for that).

Check it yourself

Browse the raw bundle · How to reproduce it · SHA-256 manifest

Related rules

• credential: every 'credential' invariant in this bundle (3 of 3 held)

all 27 · certificate →