[Audit] Re: Charter Comments -- more specific on the scope?

[Mirja Kuehlewind <[e-mail]>]

Hi Lars, hi Heime,

Please don’t overload the mailing. Please be cautious about other people‘s time in reading and following the mailing. Sending long and high frequent messages makes it harder for other people to keep up and engage. This distracts the discussion and consensus progress that should be focus on the question of forming a new working group.

Therefore please take detailed implementation discussion at this point directly among you two off-list.

Thanks!
Mirja


> Am 15.10.2026 um 14:26 schrieb Lars Kersten Kroehl <lars=[e-mail]>:
> 
> 
> Heime,
> 
> sure, we agree on the separation. The dependency establishes ordering, and currency is a second property needing its own bound. Our models differ on where that bound comes from.
> 
> In ours it travels with the authorization. The authorization carries its own validity window, the admitting party records the window it checked against, and a verifier replaying the record later sees what was in force at admission without an external clock having to agree.
> 
> Your stale-authorization case leaves a residual in that design, and the cascade does not close all of it. Revocation propagates: the issuer revokes the parent and treats every downstream authorization as revoked, a relying party that has established a revoked parent treats each descendant as invalid, and an unknown state is invalid. Discovery stays deferred, so a revocation issued after a decision and before its effect goes unseen inside the validity window. That window is the exposure, and the issuer sizes it. The trade we made is a verdict that never depends on a network fetch at decision time, since a fetch fails differently on every attempt and leaves nothing in the record. An external time bound narrows that window instead and takes on a dependency on the time source. Which trade suits a deployment depends on what it can rely on. draft-kroehl-agentic-trust-aae-02 §7.5 carries the propagation text.
> 
> On deferred replay you have the case the dependency alone doesn’t catch because a decision held and released later passes the causal test. Single use is one way out: the target consumes the decision once, by nonce, so a second presentation fails without a clock. Your seal reaches the same place by another route. A record could carry either.
> 
> Where nobody will ever re-present the record and the remaining question is when, the seal supplies something the record cannot. I agree with you there, and SCITT registration carries it for the digest.
> 
> For the charter this might stay narrow. A record format that names the consumed decision as a field of the effect, and states the validity window checked at admission, lets either answer sit underneath it, and the group could leave the time source to a later decision.
> 
> Lars
> 
> 
> _______________________________________________
> Audit mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]