CAIN-42 CAIN StudioEvidence library · niche
Identity, authority & delegation
Who an agent is, what it may do, and who allowed it. 964 tested invariants.
Last reviewed 2026-10-01
964 of 964 held
Test families in this niche
capability (54) · handshake (54) · authorization_binding (49) · aip (48) · revocation (26) · credential (25) · domain (21) · service_passport (21) · non_authority (18) · binding (16) · lease_v2 (15) · protected_key (14) · research (13) · state_machine (11) · cross_domain (11) · delegation (11) · kernel (11) · delegation_attenuation (9) · replay_revocation (9) · moat (9) · risk (6) · failure_class (6) · root_of_trust (6) · telemetry (5) · action (5) · action_binding (4) · config_key (4) · knowledge_revocation (4) · primitive (4) · agency_graph (4) · relationship (4) · delegation_receipt (3) · reassessment (3) · capability_passport (3) · authority_graph (3) · integrity (3) · consistency (3) · soc (3) · lease (3) · operation_kind (3) · event_kind (3) · exhaustion_mode (3) · gap_detector (3) · profile (3) · graph (3) · approval (2) · offline (2) · registration (2) · scientist (2) · radar (2) · federation (1) · intent (1) · tenancy (1) · cross-domain (1) · passport (1) · stage (1) · operation_state (1) · status (1) · environment_query (1) · ip (1) · competitive_gap (1) · authority_algebra (1) · minimum_authority (1) · systemic (1)
Where these come from
- CAIN-42 Evolution 24 -- Governed Agentic Internet Fabric: 198
- CAIN-42 Evolution 25 -- Universal Machine Agency Fabric: 105
- CAIN-42 Evolution 26 -- Universal Machine Agency Trust Fabric: 90
- CAIN-42 Evolution 23 -- Governed Meta-Intelligence Fabric: 84
- CAIN-42 Evolution 27 -- Agentic Internet Control Plane: 64
- CAIN-42 Evolution 31 -- Universal Proof-of-Governance Fabric: 52
- CAIN-42 Evolution 33 -- Governed Agentic Operating Fabric: 49
- CAIN-42 Evolution 36 -- Machine Agency Exchange Fabric: 49
- CAIN-42 Evolution 19 -- Governed Autonomy Operating Fabric: 43
- CAIN-42 Evolution 21 -- Governed Open-Ended Intelligence Fabric: 40
- CAIN-42 Evolution 20 -- Governed Agentic Civilization Fabric: 36
- CAIN-42 Evolution 32 -- Governed Autonomy Learning Fabric: 34
- CAIN-42 Evolution 41 -- Machine Agency Exchange Fabric: 28
- CAIN-42 Evolution 42 -- Supreme Governed Agentic Infrastructure Platform: 24
- CAIN-42 Evolution 35 -- Continuous Governance Intelligence Fabric: 21
- CAIN-42 Evolution 34 -- Proof-Carrying Machine Agency: 20
- CAIN-42 Evolution 28 -- Portable Machine Agency & Execution Identity: 18
- CAIN-42 Evolution 30 -- Governed Machine Autonomy Fabric: 2
- CAIN-42 Evolution 37 -- Autonomous Execution Mesh: 2
- CAIN-42 Evolution 38 -- Portable Proof-Carrying Machine Agency: 2
- CAIN-42 Evolution 29 -- Governed Agentic Internet Transaction Fabric: 1
- CAIN-42 Evolution 39 -- Governed Agent Factory: 1
- CAIN-42 Evolution 40 -- Autonomous Enterprise Intelligence Fabric: 1
Rules 451–600 of 964
| ID | Rule | Bundle | Result |
|---|---|---|---|
| I-CAP-transfer-target_out_of_scope | transfer: target_out_of_scope refused | E25 | held |
| I-CAP-transfer-unregistered | transfer: unregistered refused | E25 | held |
| I-CAP-write-no_delegation | write: no_delegation refused | E25 | held |
| I-CAP-write-target_out_of_scope | write: target_out_of_scope refused | E25 | held |
| I-CAP-write-unregistered | write: unregistered refused | E25 | held |
| I-BIND-intent | mutated intent cannot reuse authorization | E25 | held |
| I-BIND-execution_target | mutated execution_target cannot reuse authorization | E25 | held |
| I-BIND-operation | mutated operation cannot reuse authorization | E25 | held |
| I-BIND-parameters | mutated parameters cannot reuse authorization | E25 | held |
| I-BIND-requested_capabilities | mutated requested_capabilities cannot reuse authorization | E25 | held |
| I-BIND-resource_scope | mutated resource_scope cannot reuse authorization | E25 | held |
| I-BIND-delegation_chain | mutated delegation_chain cannot reuse authorization | E25 | held |
| I-BIND-context_digest | mutated context_digest cannot reuse authorization | E25 | held |
| I-BIND-agent_identity | mutated agent_identity cannot reuse authorization | E25 | held |
| I-BIND-agent_instance_identity | mutated agent_instance_identity cannot reuse authorization | E25 | held |
| I-BIND-principal_identity | mutated principal_identity cannot reuse authorization | E25 | held |
| I-BIND-tenant_id | mutated tenant_id cannot reuse authorization | E25 | held |
| I-BIND-nonce | mutated nonce cannot reuse authorization | E25 | held |
| I-BIND-sequence_number | mutated sequence_number cannot reuse authorization | E25 | held |
| I-BIND-timestamp_ms | mutated timestamp_ms cannot reuse authorization | E25 | held |
| I-BIND-execution_adapter | mutated execution_adapter cannot reuse authorization | E25 | held |
| I-TX-CAPABILITY_RESOLVED | CREATED->CAPABILITY_RESOLVED refused | E25 | held |
| I-TX-DELEGATION_RESOLVED | CREATED->DELEGATION_RESOLVED refused | E25 | held |
| I-TX-AUTHORITY_RESOLVED | CREATED->AUTHORITY_RESOLVED refused | E25 | held |
| I-TX-AUTHORIZATION_PENDING | CREATED->AUTHORIZATION_PENDING refused | E25 | held |
| I-TX-AUTHORIZED | CREATED->AUTHORIZED refused | E25 | held |
| I-TX-REVOKED | CREATED->REVOKED | E25 | held |
| I-TX-AUTH-agent-d | AUTHORIZED only by engine+allow | E25 | held |
| I-TX-AUTH-engine-empty | AUTHORIZED only by engine+allow | E25 | held |
| I-TX-AUTH-engine-notallowed | AUTHORIZED only by engine+allow | E25 | held |
| I-CRED-read-expired | read/expired refused | E25 | held |
| I-CRED-read-audience | read/audience refused | E25 | held |
| I-CRED-read-scope | read/scope refused | E25 | held |
| I-CRED-read-rotated | read/rotated refused | E25 | held |
| I-CRED-read-revoked | read/revoked refused | E25 | held |
| I-CRED-read-pop | read/pop refused | E25 | held |
| I-CRED-write-expired | write/expired refused | E25 | held |
| I-CRED-write-audience | write/audience refused | E25 | held |
| I-CRED-write-scope | write/scope refused | E25 | held |
| I-CRED-write-rotated | write/rotated refused | E25 | held |
| I-CRED-write-revoked | write/revoked refused | E25 | held |
| I-CRED-write-pop | write/pop refused | E25 | held |
| I-CRED-send-expired | send/expired refused | E25 | held |
| I-CRED-send-audience | send/audience refused | E25 | held |
| I-CRED-send-scope | send/scope refused | E25 | held |
| I-CRED-send-rotated | send/rotated refused | E25 | held |
| I-CRED-send-revoked | send/revoked refused | E25 | held |
| I-CRED-send-pop | send/pop refused | E25 | held |
| I-CRED-pay-expired | pay/expired refused | E25 | held |
| I-CRED-pay-audience | pay/audience refused | E25 | held |
| I-CRED-pay-scope | pay/scope refused | E25 | held |
| I-CRED-pay-rotated | pay/rotated refused | E25 | held |
| I-CRED-pay-revoked | pay/revoked refused | E25 | held |
| I-CRED-pay-pop | pay/pop refused | E25 | held |
| I-APPROVAL-quorum-required | critical requires quorum | E25 | held |
| I-APPROVAL-quorum-met | critical with quorum ALLOWs | E25 | held |
| I-AUTHZ-binding-intent_digest-1 | intent_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-intent_digest-2 | intent_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-intent_digest-3 | intent_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-intent_digest-4 | intent_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-intent_digest-5 | intent_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-intent_digest-6 | intent_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-intent_digest-7 | intent_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-action_digest-1 | action_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-action_digest-2 | action_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-action_digest-3 | action_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-action_digest-4 | action_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-action_digest-5 | action_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-action_digest-6 | action_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-action_digest-7 | action_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-resource_digest-1 | resource_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-resource_digest-2 | resource_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-resource_digest-3 | resource_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-resource_digest-4 | resource_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-resource_digest-5 | resource_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-resource_digest-6 | resource_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-resource_digest-7 | resource_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-capability_digest-1 | capability_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-capability_digest-2 | capability_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-capability_digest-3 | capability_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-capability_digest-4 | capability_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-capability_digest-5 | capability_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-capability_digest-6 | capability_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-capability_digest-7 | capability_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-policy_digest-1 | policy_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-policy_digest-2 | policy_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-policy_digest-3 | policy_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-policy_digest-4 | policy_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-policy_digest-5 | policy_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-policy_digest-6 | policy_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-policy_digest-7 | policy_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-authority_digest-1 | authority_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-authority_digest-2 | authority_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-authority_digest-3 | authority_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-authority_digest-4 | authority_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-authority_digest-5 | authority_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-authority_digest-6 | authority_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-authority_digest-7 | authority_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-context_digest-1 | context_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-context_digest-2 | context_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-context_digest-3 | context_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-context_digest-4 | context_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-context_digest-5 | context_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-context_digest-6 | context_digest mismatch detected | E26 | held |
| I-AUTHZ-binding-context_digest-7 | context_digest mismatch detected | E26 | held |
| I-DELEG-attenuate-valid | valid attenuation accepted | E26 | held |
| I-DELEG-expand-capability | expansion capability refused | E26 | held |
| I-DELEG-expand-resource | expansion resource refused | E26 | held |
| I-DELEG-expand-time | expansion time refused | E26 | held |
| I-DELEG-expand-budget | expansion budget refused | E26 | held |
| I-DELEG-expand-rate | expansion rate refused | E26 | held |
| I-DELEG-expand-geography | expansion geography refused | E26 | held |
| I-DELEG-expand-tool | expansion tool refused | E26 | held |
| I-DELEG-expand-transaction_count | expansion transaction_count refused | E26 | held |
| I-DRECEIPT-chain | receipt chain verifies | E26 | held |
| I-DRECEIPT-tamper | tampered receipt detected | E26 | held |
| I-DRECEIPT-bind | receipt binds capability | E26 | held |
| I-REV-agent | revoke agent | E26 | held |
| I-REV-instance | revoke instance | E26 | held |
| I-REV-credential | revoke credential | E26 | held |
| I-REV-delegation | revoke delegation | E26 | held |
| I-REV-capability | revoke capability | E26 | held |
| I-REV-authorization | revoke authorization | E26 | held |
| I-REV-runtime | revoke runtime | E26 | held |
| I-REV-trust_domain | revoke trust_domain | E26 | held |
| I-REV-pull-agent | pull sees agent | E26 | held |
| I-REV-pull-instance | pull sees instance | E26 | held |
| I-REV-pull-credential | pull sees credential | E26 | held |
| I-REV-pull-delegation | pull sees delegation | E26 | held |
| I-REV-pull-capability | pull sees capability | E26 | held |
| I-REV-pull-authorization | pull sees authorization | E26 | held |
| I-REV-pull-runtime | pull sees runtime | E26 | held |
| I-REV-pull-trust_domain | pull sees trust_domain | E26 | held |
| I-FED-nopolicy | no policy means no authority | E26 | held |
| I-OFFLINE-valid | valid authorization verifies offline | E26 | held |
| I-OFFLINE-revocation-unknown | offline never asserts revocation status | E26 | held |
| I-REASSESS-identity_change | trigger identity_change | E26 | held |
| I-REASSESS-delegation_change | trigger delegation_change | E26 | held |
| I-REASSESS-capability_change | trigger capability_change | E26 | held |
| I-PASSPORT-sign | passport signs | E26 | held |
| I-PASSPORT-perm | passport permission enforced | E26 | held |
| I-PASSPORT-amount | passport amount enforced | E26 | held |
| I-AG-root | root principal found | E26 | held |
| I-AG-attenuate | attenuation detected | E26 | held |
| I-AG-descendants | descendants found | E26 | held |
| I-INTENT-approved | authorization recorded | E26 | held |
| I-AIP-DISCOVER | message DISCOVER | E27 | held |
| I-AIP-IDENTIFY | message IDENTIFY | E27 | held |
| I-AIP-ATTEST | message ATTEST | E27 | held |
| I-AIP-NEGOTIATE | message NEGOTIATE | E27 | held |
Other niches
Consensus & distributed systems · Attacks, threats & containment · Evidence, receipts & proofs · Memory, data & privacy · Prediction, world models & simulation · Transactions, markets & economics · Tools, MCP, protocols & adapters · Autonomy, control loops & recovery · Policy, law & governance · Trust & reputation · Supply chain, registry & lifecycle · Benchmarks, coverage & performance · Core guarantees
Try CAIN-42 on your own agents
Create a free account and every new account starts with a 7-day trial of the full platform. Or try the sandbox first, with no account at all.
Create a free account → · Try the sandbox · See the whole ecosystem