RAIFFAGuides

Guide 02 · EXACT BINDING

LOCAL SIMULATION · TEST_ONLYLocal validation surfaces and fixed fixtures only · no real login, organizational authority, operational API, external execution, or authority issuance

Check the requester and scope.

Do not infer authority from a title or UI state; bind actor, session, role, delegation, case, and scope exactly.

01

Identity is a validation chain, not one string

  • Authenticated subject and session assertion
  • Organization and tenant binding
  • Current role and assurance mode
  • Delegation issuer, delegate, and allowed scope
  • Policy version and validity window
  • Revocation revision and lifecycle state
02

Never widen scope by interpretation

Requested action, subject, purpose, case, and boundary must match the authorized scope exactly. A senior title or similar subject does not expand the binding.

  1. 01
    Verify the request actor

    Match the session subject to the actor named in the request.

  2. 02
    Verify delegation

    Check who delegated which scope, until when, and under which separation-of-duty rules.

  3. 03
    Verify case binding

    Match current DecisionCaseRef id, digest, and issuer exactly.

  4. 04
    Compare scope

    Close the path when operation, boundary, tenant, or case differs.

03

Current scope: owner-held TEST_ONLY validation

Policy/Identity packages validate local source and owner-attested plan structure. They do not provide a real IdP login, organization directory, production session persistence, or entitlement writer.