niko_trust/docs/DELEGATION.md

Delegation

How one identity lends its voice to another, and how a verifier decides whether a claim made by someone it does not know is backed by someone it does.

The wire object is DelegationClaim (PROTOCOL.md §8.7, tag 0x07). This document is about what it means and how chains are resolved.

---

1. The statement

granter says: grantee may issue claims covering these exact predicates,
              re-delegating at most max_depth further times.

• Exact predicates only. {minecraft.op: true} covers the key minecraft.op and nothing else. There are no prefixes and no wildcards: a grant of user. that silently covered users.admin would turn an administrative convenience into an escalation primitive.
• Every predicate value is the boolean true, enforced at decode time. Coverage is membership, not interpretation (INV-5).
• max_depth counts hops below the grant. 0 means the grantee speaks for itself only; 2 allows the grantee to delegate onward once, and that sub-grantee once more.
• Revocation mirrors claims: the granter signs a Revocation targeting the delegation's object ID. Expired grants die on their own; supersession (serial) replaces terms without revoking history.

2. Chain resolution

A consumer anchors trust in roots — issuers it already decided to believe (Policy.TrustedIssuers). When a claim's issuer is not a root, the verifier searches for a path:

trusted root ──grant──▶ … ──grant──▶ claim issuer ──claim──▶ subject

Rules, implemented deterministically in verify.Graph:

1. Every link must be signature-valid, current at the evaluation instant, unrevoked by its granter, and cover the claim's exact predicate.
2. Where several grants could serve, the highest serial wins, ties broken by lowest content ID — map order never leaks into a decision.
3. Total hops are bounded by Policy.MaxDepth (default 3), and each link's own max_depth must fit the hops below it: link i of k needs max_depth ≥ k−1−i.
4. Cycles cannot loop: depth bounds terminate every walk.
5. The accepted result reports the full path in Result.Chain (issuer → … → root) as audit evidence.

An empty TrustedIssuers keeps the original model exactly: any issuer the consumer fed into the graph may satisfy the policy directly. Delegation only activates when roots are named.

3. What delegation does not mean

• It is not identity merging: the claim still names its real issuer, and the chain names everyone who lent authority.
• It is not transitive by default: a root that grants with max_depth: 0 creates exactly one hop and nothing more.
• A hostile link can stop forwarding, but cannot forge: every hop is signed by its own granter, and the root sees only grants it signed itself.