CAIN-42 CAIN StudioDelegation
An agent can hand a sub-agent a narrower credential (POST /broker-keystone/attenuate). Since
2026-11-02 the rules are strict, because the old ones let a credential grow.
| Child request | Rule |
|---|---|
| Same action, shorter life | Allowed. The child expires no later than the parent. |
| Different method | Refused. |
| Same path, different body | Refused. |
A member of a collection (parent path ends in /, e.g. /customers/ → /customers/C-77) | Allowed only if the parent carries no body and no person's approval; the child carries no body. |
A deeper path under a non-collection path (/orders/A-1 → /orders/A-1/x) | Refused (before: allowed, with any body). |
| Anything else from a person-approved credential | Refused (before: an approved DELETE could spawn an unapproved one). |
One use per family
A child names its parent (parent_jti) and the family root (root_jti). Using any member of the family
spends the family's one use. Before 2026-11-02, a parent and any number of identical children were each usable once:
one credential, many uses.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.