CAIN-42 CAIN StudioEvidence library · niche
Identity, authority & delegation
Who an agent is, what it may do, and who allowed it. 964 tested invariants.
Last reviewed 2026-10-01
964 of 964 held
Test families in this niche
capability (54) · handshake (54) · authorization_binding (49) · aip (48) · revocation (26) · credential (25) · domain (21) · service_passport (21) · non_authority (18) · binding (16) · lease_v2 (15) · protected_key (14) · research (13) · state_machine (11) · cross_domain (11) · delegation (11) · kernel (11) · delegation_attenuation (9) · replay_revocation (9) · moat (9) · risk (6) · failure_class (6) · root_of_trust (6) · telemetry (5) · action (5) · action_binding (4) · config_key (4) · knowledge_revocation (4) · primitive (4) · agency_graph (4) · relationship (4) · delegation_receipt (3) · reassessment (3) · capability_passport (3) · authority_graph (3) · integrity (3) · consistency (3) · soc (3) · lease (3) · operation_kind (3) · event_kind (3) · exhaustion_mode (3) · gap_detector (3) · profile (3) · graph (3) · approval (2) · offline (2) · registration (2) · scientist (2) · radar (2) · federation (1) · intent (1) · tenancy (1) · cross-domain (1) · passport (1) · stage (1) · operation_state (1) · status (1) · environment_query (1) · ip (1) · competitive_gap (1) · authority_algebra (1) · minimum_authority (1) · systemic (1)
Where these come from
- CAIN-42 Evolution 24 -- Governed Agentic Internet Fabric: 198
- CAIN-42 Evolution 25 -- Universal Machine Agency Fabric: 105
- CAIN-42 Evolution 26 -- Universal Machine Agency Trust Fabric: 90
- CAIN-42 Evolution 23 -- Governed Meta-Intelligence Fabric: 84
- CAIN-42 Evolution 27 -- Agentic Internet Control Plane: 64
- CAIN-42 Evolution 31 -- Universal Proof-of-Governance Fabric: 52
- CAIN-42 Evolution 33 -- Governed Agentic Operating Fabric: 49
- CAIN-42 Evolution 36 -- Machine Agency Exchange Fabric: 49
- CAIN-42 Evolution 19 -- Governed Autonomy Operating Fabric: 43
- CAIN-42 Evolution 21 -- Governed Open-Ended Intelligence Fabric: 40
- CAIN-42 Evolution 20 -- Governed Agentic Civilization Fabric: 36
- CAIN-42 Evolution 32 -- Governed Autonomy Learning Fabric: 34
- CAIN-42 Evolution 41 -- Machine Agency Exchange Fabric: 28
- CAIN-42 Evolution 42 -- Supreme Governed Agentic Infrastructure Platform: 24
- CAIN-42 Evolution 35 -- Continuous Governance Intelligence Fabric: 21
- CAIN-42 Evolution 34 -- Proof-Carrying Machine Agency: 20
- CAIN-42 Evolution 28 -- Portable Machine Agency & Execution Identity: 18
- CAIN-42 Evolution 30 -- Governed Machine Autonomy Fabric: 2
- CAIN-42 Evolution 37 -- Autonomous Execution Mesh: 2
- CAIN-42 Evolution 38 -- Portable Proof-Carrying Machine Agency: 2
- CAIN-42 Evolution 29 -- Governed Agentic Internet Transaction Fabric: 1
- CAIN-42 Evolution 39 -- Governed Agent Factory: 1
- CAIN-42 Evolution 40 -- Autonomous Enterprise Intelligence Fabric: 1
Rules 301–450 of 964
| ID | Rule | Bundle | Result |
|---|---|---|---|
| NET-L08 | NET-L08 CONTRACT IS NOT AUTHORITY | E24 | held |
| NET-L09 | NET-L09 MONEY IS NOT AUTHORITY | E24 | held |
| NET-L10 | NET-L10 REPUTATION IS NOT AUTHORITY | E24 | held |
| NET-L12 | NET-L12 IDENTITY DOES NOT IMPLY AUTHORITY | E24 | held |
| NET-L13 | NET-L13 A CAPABILITY ADVERTISEMENT IS A CLAIM | E24 | held |
| NET-L14 | NET-L14 LOSS OF CONNECTIVITY NEVER CREATES AUTHORITY | E24 | held |
| NET-L19 | NET-L19 MEMORY IS NOT TRUST, AUTHORITY OR FACT | E24 | held |
| NET-L20 | NET-L20 ROUTING NEVER CHANGES AUTHORITY | E24 | held |
| NET-SOUND-agent-a-agent-b-read | agent-a -> agent-b read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-b-notify | agent-a -> agent-b notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-b-dispatch | agent-a -> agent-b dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-b-write | agent-a -> agent-b write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-c-read | agent-a -> agent-c read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-c-notify | agent-a -> agent-c notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-c-dispatch | agent-a -> agent-c dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-c-write | agent-a -> agent-c write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-a2-read | agent-a -> agent-a2 read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-a2-notify | agent-a -> agent-a2 notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-a2-dispatch | agent-a -> agent-a2 dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-a2-write | agent-a -> agent-a2 write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-c2-read | agent-a -> agent-c2 read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-c2-notify | agent-a -> agent-c2 notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-c2-dispatch | agent-a -> agent-c2 dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a-agent-c2-write | agent-a -> agent-c2 write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-a-read | agent-b -> agent-a read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-a-notify | agent-b -> agent-a notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-a-dispatch | agent-b -> agent-a dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-a-write | agent-b -> agent-a write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-c-read | agent-b -> agent-c read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-c-notify | agent-b -> agent-c notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-c-dispatch | agent-b -> agent-c dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-c-write | agent-b -> agent-c write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-a2-read | agent-b -> agent-a2 read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-a2-notify | agent-b -> agent-a2 notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-a2-dispatch | agent-b -> agent-a2 dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-a2-write | agent-b -> agent-a2 write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-c2-read | agent-b -> agent-c2 read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-c2-notify | agent-b -> agent-c2 notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-c2-dispatch | agent-b -> agent-c2 dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-b-agent-c2-write | agent-b -> agent-c2 write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-a-read | agent-c -> agent-a read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-a-notify | agent-c -> agent-a notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-a-dispatch | agent-c -> agent-a dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-a-write | agent-c -> agent-a write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-b-read | agent-c -> agent-b read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-b-notify | agent-c -> agent-b notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-b-dispatch | agent-c -> agent-b dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-b-write | agent-c -> agent-b write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-a2-read | agent-c -> agent-a2 read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-a2-notify | agent-c -> agent-a2 notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-a2-dispatch | agent-c -> agent-a2 dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-a2-write | agent-c -> agent-a2 write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-c2-read | agent-c -> agent-c2 read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-c2-notify | agent-c -> agent-c2 notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-c2-dispatch | agent-c -> agent-c2 dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c-agent-c2-write | agent-c -> agent-c2 write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-a-read | agent-a2 -> agent-a read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-a-notify | agent-a2 -> agent-a notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-a-dispatch | agent-a2 -> agent-a dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-a-write | agent-a2 -> agent-a write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-b-read | agent-a2 -> agent-b read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-b-notify | agent-a2 -> agent-b notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-b-dispatch | agent-a2 -> agent-b dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-b-write | agent-a2 -> agent-b write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-c-read | agent-a2 -> agent-c read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-c-notify | agent-a2 -> agent-c notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-c-dispatch | agent-a2 -> agent-c dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-c-write | agent-a2 -> agent-c write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-c2-read | agent-a2 -> agent-c2 read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-c2-notify | agent-a2 -> agent-c2 notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-c2-dispatch | agent-a2 -> agent-c2 dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-a2-agent-c2-write | agent-a2 -> agent-c2 write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-a-read | agent-c2 -> agent-a read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-a-notify | agent-c2 -> agent-a notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-a-dispatch | agent-c2 -> agent-a dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-a-write | agent-c2 -> agent-a write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-b-read | agent-c2 -> agent-b read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-b-notify | agent-c2 -> agent-b notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-b-dispatch | agent-c2 -> agent-b dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-b-write | agent-c2 -> agent-b write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-c-read | agent-c2 -> agent-c read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-c-notify | agent-c2 -> agent-c notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-c-dispatch | agent-c2 -> agent-c dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-c-write | agent-c2 -> agent-c write: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-a2-read | agent-c2 -> agent-a2 read: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-a2-notify | agent-c2 -> agent-a2 notify: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-a2-dispatch | agent-c2 -> agent-a2 dispatch: authorized only if independently derivable, via E8 | E24 | held |
| NET-SOUND-agent-c2-agent-a2-write | agent-c2 -> agent-a2 write: authorized only if independently derivable, via E8 | E24 | held |
| NET-U-a2a | a2a: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| NET-U-mcp | mcp: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| NET-U-http | http: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| NET-U-rest | rest: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| NET-U-grpc | grpc: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| NET-U-websocket | websocket: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| NET-U-event_bus | event_bus: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| NET-U-message_queue | message_queue: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| NET-U-cli | cli: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| NET-U-browser | browser: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| NET-U-computer_use | computer_use: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| NET-U-local_ipc | local_ipc: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| NET-U-cloud_api | cloud_api: an unmapped operation normalizes to UNKNOWN (never to a capability) | E24 | held |
| I-CAP-configure-no_delegation | configure: no_delegation refused | E25 | held |
| I-CAP-configure-target_out_of_scope | configure: target_out_of_scope refused | E25 | held |
| I-CAP-configure-unregistered | configure: unregistered refused | E25 | held |
| I-CAP-create-no_delegation | create: no_delegation refused | E25 | held |
| I-CAP-create-target_out_of_scope | create: target_out_of_scope refused | E25 | held |
| I-CAP-create-unregistered | create: unregistered refused | E25 | held |
| I-CAP-credential-no_delegation | credential: no_delegation refused | E25 | held |
| I-CAP-credential-target_out_of_scope | credential: target_out_of_scope refused | E25 | held |
| I-CAP-credential-unregistered | credential: unregistered refused | E25 | held |
| I-CAP-delegate-no_delegation | delegate: no_delegation refused | E25 | held |
| I-CAP-delegate-target_out_of_scope | delegate: target_out_of_scope refused | E25 | held |
| I-CAP-delegate-unregistered | delegate: unregistered refused | E25 | held |
| I-CAP-delete-no_delegation | delete: no_delegation refused | E25 | held |
| I-CAP-delete-target_out_of_scope | delete: target_out_of_scope refused | E25 | held |
| I-CAP-delete-unregistered | delete: unregistered refused | E25 | held |
| I-CAP-deploy-no_delegation | deploy: no_delegation refused | E25 | held |
| I-CAP-deploy-target_out_of_scope | deploy: target_out_of_scope refused | E25 | held |
| I-CAP-deploy-unregistered | deploy: unregistered refused | E25 | held |
| I-CAP-destroy-no_delegation | destroy: no_delegation refused | E25 | held |
| I-CAP-destroy-target_out_of_scope | destroy: target_out_of_scope refused | E25 | held |
| I-CAP-destroy-unregistered | destroy: unregistered refused | E25 | held |
| I-CAP-execute-no_delegation | execute: no_delegation refused | E25 | held |
| I-CAP-execute-target_out_of_scope | execute: target_out_of_scope refused | E25 | held |
| I-CAP-execute-unregistered | execute: unregistered refused | E25 | held |
| I-CAP-list-no_delegation | list: no_delegation refused | E25 | held |
| I-CAP-list-target_out_of_scope | list: target_out_of_scope refused | E25 | held |
| I-CAP-list-unregistered | list: unregistered refused | E25 | held |
| I-CAP-notify-no_delegation | notify: no_delegation refused | E25 | held |
| I-CAP-notify-target_out_of_scope | notify: target_out_of_scope refused | E25 | held |
| I-CAP-notify-unregistered | notify: unregistered refused | E25 | held |
| I-CAP-observe-no_delegation | observe: no_delegation refused | E25 | held |
| I-CAP-observe-target_out_of_scope | observe: target_out_of_scope refused | E25 | held |
| I-CAP-observe-unregistered | observe: unregistered refused | E25 | held |
| I-CAP-pay-no_delegation | pay: no_delegation refused | E25 | held |
| I-CAP-pay-target_out_of_scope | pay: target_out_of_scope refused | E25 | held |
| I-CAP-pay-unregistered | pay: unregistered refused | E25 | held |
| I-CAP-query-no_delegation | query: no_delegation refused | E25 | held |
| I-CAP-query-target_out_of_scope | query: target_out_of_scope refused | E25 | held |
| I-CAP-query-unregistered | query: unregistered refused | E25 | held |
| I-CAP-read-no_delegation | read: no_delegation refused | E25 | held |
| I-CAP-read-target_out_of_scope | read: target_out_of_scope refused | E25 | held |
| I-CAP-read-unregistered | read: unregistered refused | E25 | held |
| I-CAP-send-no_delegation | send: no_delegation refused | E25 | held |
| I-CAP-send-target_out_of_scope | send: target_out_of_scope refused | E25 | held |
| I-CAP-send-unregistered | send: unregistered refused | E25 | held |
| I-CAP-submit-no_delegation | submit: no_delegation refused | E25 | held |
| I-CAP-submit-target_out_of_scope | submit: target_out_of_scope refused | E25 | held |
| I-CAP-submit-unregistered | submit: unregistered refused | E25 | held |
| I-CAP-transfer-no_delegation | transfer: no_delegation refused | E25 | held |
Other niches
Consensus & distributed systems · Attacks, threats & containment · Evidence, receipts & proofs · Memory, data & privacy · Prediction, world models & simulation · Transactions, markets & economics · Tools, MCP, protocols & adapters · Autonomy, control loops & recovery · Policy, law & governance · Trust & reputation · Supply chain, registry & lifecycle · Benchmarks, coverage & performance · Core guarantees
Try CAIN-42 on your own agents
Create a free account and every new account starts with a 7-day trial of the full platform. Or try the sandbox first, with no account at all.
Create a free account → · Try the sandbox · See the whole ecosystem