CAIN-42 CAIN StudioLimits
| Limit | Why it matters |
|---|---|
| Software minting key (SOFTWARE_TEST) | Anyone with the gateway host could mint credentials |
The downstream service must keep its own shared seen store | Single use downstream is only as good as that store |
Grants match path patterns with *, which also matches / | /orders/* covers /orders/A-1/refund; write grants with that in mind |
| Queries are bound but not constrained by grants | A grant cannot say which query parameters are allowed |
| Demo grants only on the public site | The public routes mint only for the demo API |
| Our own testing | No independent review yet |
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.