Authorization invariants

These should be hard-coded invariants rather than configurable preferences.

Deny by default.
Explicit deny overrides allow.
A child’s self permissions must be a subset of its parent’s child ceiling.
A child’s delegation permissions must be a subset of its parent’s propagation ceiling.
A child’s resource scope cannot be broader than its parent’s scope.
A child’s expiration cannot exceed its parent’s expiration or child-TTL ceiling.
A child cannot increase delegation depth.
A child cannot remove an approval requirement inherited from its parent.
A child cannot reduce required signature strength.
A revoked ancestor invalidates its entire descendant chain.
Suspension of an ancestor temporarily suspends descendants.
Historical signatures retain historical verification status after rotation.
Revocation prevents new actions; it does not rewrite historical provenance.
No API Key can modify the Owner’s password, email, sessions, billing, or recovery mechanisms.
Provisioning source never participates in authorization.
Possession of a Credential ID or public key grants no permission.
Keyring membership never automatically grants the authority of a contained Key.
A Key may never grant a permission it cannot itself delegate.
A policy expansion always creates a new policy version and event.
No event or signature can be edited in place.