41. Identity, authorization, privacy, and adversarial-security runtime

Unbreakable identity boundary
VIN, registration plate, serial, transponder, MAC address, image match, physical proximity, profile administration, follower count and persona continuity never authenticate a human or prove ownership, custody, sale authority, publication authority, spending authority or control authority.

Canonical authentication objects
Principal {
  principalId: UUIDv4, tenantId: UUIDv4,
  kind: HUMAN|ORGANIZATION|WORKLOAD|DEVICE|PROVIDER,
  status: PENDING|ACTIVE|SUSPENDED|RECOVERY_LOCKED|RETIRED,
  assurancePolicyRef, keySetId, recoveryPolicyRef,
  legalIdentityRef?, jurisdictionRefs[], principalEpoch, createdAt
}

AgentInstance {
  agentInstanceId: UUIDv4, workloadPrincipalId,
  representedPersonaIds[], modelRuntimeRef, skillManifestDigest,
  deploymentDigest, maximumRiskTier, validInterval, status
}

CredentialBinding {
  credentialBindingId, principalId,
  kind: WEBAUTHN|MTLS|DPOP_KEY|DEVICE_KEY|RECOVERY_KEY,
  publicKeyThumbprint, algorithmSuite, authenticatorClass,
  hardwareBacked, userVerificationRequired, attestationRef?,
  keyEpoch, validInterval,
  status: ACTIVE|ROTATED|REVOKED|COMPROMISED|EXPIRED,
  compromiseEffectiveAt?
}

AuthenticatedContext {
  authenticationContextId, principalId, credentialBindingId, sessionId,
  authenticatedAt, authenticationAgeSeconds, assuranceLevel,
  userPresence, userVerification, devicePrincipalId?, workloadPrincipalId?,
  audience, channelBindingRef?, networkRiskClass, expiresAt
}

Relationship and grant records
RelationshipEdge {
  relationshipId, subjectId, predicate, objectId, issuerPrincipalId,
  authorityBasisRefs[], scopeSelectors[], validInterval, recordedAt,
  relationshipEpoch, status: ACTIVE|REVOKED|EXPIRED|DISPUTED, proofRefs[]
}

Privileged predicates are a closed registry:
  owns_title_interest_in  has_custody_of  may_operate  may_maintain
  may_publish_for         may_manage_profile  may_list_for_sale
  may_accept_offer        may_transfer_right  may_spend_for
  is_beneficiary_of       may_review_content  may_review_candidate
  may_subdelegate

CapabilityGrant {
  grantId, issuerPrincipalId, granteePrincipalId, granteeAgentInstanceId?,
  delegatorGrantId?, authorityBasisRefs[], actions[], resourceSelectors[],
  fieldSelectors[], effectClasses[], providerAllowlist[], purposeSet[],
  audienceSet[], channelSet[], jurisdictionSet[], dataClassCeiling,
  locationPrecisionCeiling?, monetaryConstraints?, countAndRateConstraints?,
  contextualConstraints[], confirmationPolicyRef, obligations[],
  prohibitions[], retentionRuleRefs[], delegationPolicy,
  validInterval, grantEpoch, principalEpoch, personaEpoch?, nonce, proofRefs[]
}

Fail-closed ABAC/ReBAC evaluation
decide(request):
  require schema_valid(request) and digest(request.proposal)==request.proposalDigest
  auth = verify_transport_and_session(request.transportProof)
  require auth.current and auth.audience == this_service
  require auth.principalEpoch == currentPrincipalEpoch(auth.principalId)

  effects = classify_effects(request.proposal)
  risk = aggregate_risk(effects, amount, audience, disclosure, repetition)
  if PHYSICAL_ACTUATION in effects: DENY("social-plane-actuation")

  attrs = resolve_at(validAt=request.validAt, knownAt=now,
                     relationshipCheckpoint=currentGraphCheckpoint,
                     evidenceCheckpoint=request.evidenceCheckpoint)
  if required attribute missing, stale, conflicted or disputed: DENY

  grants = verify_authority_chains_and_attenuation(request, attrs)
  if any hard prohibition, incident, safety, court, legal-hold,
     rights, consent or revocation denial applies: DENY
  if no explicit grant contains exact action/resources/purpose/context: DENY

  duties = union_required_duties(grants, rights, consent, risk)
  if duties conflict or cannot be enforced: DENY
  if confirmation required and exact unconsumed challenge is absent: CHALLENGE
  reservation = atomically_reserve_budget_rate_inventory(request)
  if reservation fails: DENY

  return PERMIT_WITH_DUTIES(
    proposalDigest, policyDigest, all epochs, both checkpoints,
    grantIds, dutySet, reservationId, expiresAt, oneTimeDispatchNonce)

Before connector dispatch, repeat the decision against current terms, amount,
counterparty, beneficiary, grants, epochs, incident state, confirmation and
reservation. INDETERMINATE is enforced as DENY. Explicit deny overrides permit.

Permission types remain independent
DataUseDeclaration {
  controllerPrincipalId, processorPrincipalIds[], dataSubjectRefs[],
  dataCategorySelectors[], sourceSelectors[], operations[], purposes[],
  recipientClasses[], modelTrainingUse, automatedDecisionUse,
  jurisdictions[], noticeVersion, retentionScheduleRef, securityProfileRef
}

ConsentGrant {
  dataSubjectPrincipalId, controllerPrincipalId, declarationId,
  acceptedPurposes[], acceptedOperations[], acceptedDataSelectors[],
  acceptedRecipientClasses[], affirmativeActionRef, noticeArtifactDigest,
  presentedLanguage, acceptedAt, validInterval, consentEpoch, status
}

RightsGrant {
  rightsholderPrincipalId, granteePrincipalId, assetOrWorkIds[],
  rightKinds[], permittedUses[], prohibitedUses[], territory[], language[],
  channel[], audience[], derivativePolicy, trainingPolicy,
  sublicensingPolicy, approvalPolicy, compensationRef?, validInterval
}

DisclosureReceipt {
  recipientPrincipalOrClass, dataSubjectRefs[], sourceRecordIds[],
  exactProjectionDigest, fieldsReleased[], fieldsRedacted[], purpose,
  legalBasisOrConsentRefs[], rightsGrantRefs[], jurisdiction,
  recipientDuties[], retentionAfterDisclosure, channel,
  transportProofRef, policyDecisionId, disclosedAt
}

Retention interval computation
earliestPermittedDeletion = max(all applicable minimum-retain bounds)
latestRequiredDeletion     = min(all applicable delete-no-later bounds)

If earliestPermittedDeletion > latestRequiredDeletion and no exact scoped hold
resolves the conflict, enter COMPLIANCE_CONFLICT. A legal hold names subjects,
record classes, interval, issuer, authority, reason, review date and expiry.

Typed tool broker and connector manifest
ConnectorManifest {
  connectorId, version, providerPrincipalId, supportedActionKinds[],
  maximumRiskTier, requestSchemaDigestByAction{}, responseSchemaDigestByAction{},
  registeredOrigins[], serviceIdentityProfile, inboundWebhookSignatureProfile?,
  credentialVaultRef, providerIdempotencyClass: STRONG|QUERYABLE|NON_IDEMPOTENT,
  statusQueryProfile?, compensationProfiles[], retryPolicy, timeoutPolicy,
  ratePolicy, dataDisclosureProfile, egressAllowlist, sandboxProfile,
  manifestDigest, approverIds[], status
}

Model outputs are restricted to NarrativeDraft, MemoryProposal or ActionProposal.
They cannot call HTTP, browser, shell, SQL, filesystem, broker or generic messaging.
The broker validates a typed proposal and deterministically renders one registered
provider request. NON_IDEMPOTENT connectors cannot autonomously execute R3/R4.

Attributable action evidence—without absolute legal claims
AuditEvent {
  auditEventId, tenantId, actorPrincipalId, agentInstanceId?,
  credentialBindingId?, authenticationContextId?, actionKind, resourceIds[],
  proposalDigest?, beforeStateDigest?, afterStateDigest?, policyDecisionId?,
  grantIds[], confirmationArtifactId?, connectorOperationId?, providerReceiptIds[],
  outcome, failureCode?, occurredAt, recordedAt, clockUncertainty,
  correlationId, traceId, previousAuditDigest, auditDigest, proofRefs[]
}

TransparencyCheckpoint {
  checkpointId, tenantOrShard, firstSequence, lastSequence, merkleRoot,
  previousCheckpointDigest, signerKeyId, signedAt,
  independentWitnessReceipts[], storageRetentionRef
}