RAIFFAFoundations

Foundation · OWNER HELD

LOCAL SIMULATION · TEST_ONLYLocal validation surfaces and fixed fixtures only · no real login, organizational authority, operational API, external execution, or authority issuance

Policy, identity, and delegation

Policy defines the conditions. Identity and session records establish who is making the request. Eligibility also depends on the current role, delegation, and revocation state.

01

Five objects retain separate responsibilities

  • Policy — what is allowed or denied under which conditions
  • Identity — which issuer asserts the current actor
  • Session — authentication and assurance for this request
  • Role context — which role is valid in this organization and scope
  • Delegation — who transferred which bounded authority to whom and until when
02

Delegation narrows authority; it does not expand it

A delegation cannot create broader scope, later expiry, or weaker assurance than the source authority. Verify issuer, delegate, allowed scope, validity, and revocation.

  1. 01
    Verify the source authority

    The delegator must be able to delegate this exact scope.

  2. 02
    Narrow the limits

    State subject, operation, impact limit, and time window.

  3. 03
    Bind the delegate

    Connect delegate identity to current session context.

  4. 04
    Propagate revocation

    Track how revoking an upstream delegation invalidates downstream context.

03

Current scope: owner-attested local validation

The Policy/Identity workspace provides local source, integrity manifests, and TEST_ONLY scenarios. It does not claim a real organization policy publisher, IdP, HSM/key management, operational directory, or production entitlement system.