{"file":"docs/seed/Authorization_Invariants.txt","start":1,"end":24,"lines":[{"number":1,"text":"Authorization invariants"},{"number":2,"text":""},{"number":3,"text":"These should be hard-coded invariants rather than configurable preferences."},{"number":4,"text":""},{"number":5,"text":"Deny by default."},{"number":6,"text":"Explicit deny overrides allow."},{"number":7,"text":"A child’s self permissions must be a subset of its parent’s child ceiling."},{"number":8,"text":"A child’s delegation permissions must be a subset of its parent’s propagation ceiling."},{"number":9,"text":"A child’s resource scope cannot be broader than its parent’s scope."},{"number":10,"text":"A child’s expiration cannot exceed its parent’s expiration or child-TTL ceiling."},{"number":11,"text":"A child cannot increase delegation depth."},{"number":12,"text":"A child cannot remove an approval requirement inherited from its parent."},{"number":13,"text":"A child cannot reduce required signature strength."},{"number":14,"text":"A revoked ancestor invalidates its entire descendant chain."},{"number":15,"text":"Suspension of an ancestor temporarily suspends descendants."},{"number":16,"text":"Historical signatures retain historical verification status after rotation."},{"number":17,"text":"Revocation prevents new actions; it does not rewrite historical provenance."},{"number":18,"text":"No API Key can modify the Owner’s password, email, sessions, billing, or recovery mechanisms."},{"number":19,"text":"Provisioning source never participates in authorization."},{"number":20,"text":"Possession of a Credential ID or public key grants no permission."},{"number":21,"text":"Keyring membership never automatically grants the authority of a contained Key."},{"number":22,"text":"A Key may never grant a permission it cannot itself delegate."},{"number":23,"text":"A policy expansion always creates a new policy version and event."},{"number":24,"text":"No event or signature can be edited in place."}]}