[Audit] Re: Mandate freshness: when valid delegation outlives current human intent

[Mohamad Khalil Yossif <[e-mail]>]

> Jiayu,
> 
> The distinction you are drawing is real and it is not token expiry.
> 
> A grant can be unexpired, unrevoked, and correctly scoped while the
> objective behind it has moved. Nothing in the authorization state
> records that, because the authorization state was never a record of
> the objective. It was a record of what was permitted.
> 
> I published a problem statement on this in July:
> 
>   https://datatracker.ietf.org/doc/draft-yossif-agent-mandate-problem/
> 
> It states requirements and proposes no mechanism, deliberately. It
> does not cover the case you are naming — it treats the mandate as
> fixed once signed and asks whether later actions stay inside it. The
> question of whether the mandate still reflects current intent is a
> different one, and the draft does not ask it.
> 
> Andreas Ehstand raised an adjacent gap on the same draft last week:
> whether the Principal held the authority to grant in the first place.
> His view, which I think is right, is that these separate into a
> grant-time question and a use-time question, and that a requirement
> could ask a mandate to state which rule governs it rather than
> choosing one.
> 
> Yours sits with the use-time half. If a mandate declares that it is
> governed at use time, something has to be checkable at that moment,
> and "the objective has not changed" is harder to make checkable than
> "the signer's authority has not been withdrawn."
> 
> Whether that belongs in the AUDIT charter I do not know. It may be
> closer to the authorization layer than to the audit layer. But the
> distinction is worth keeping separate from expiry wherever it lands,
> because a system that only checks expiry will report the stale case
> as valid.
> 
> Mohamad Khalil Yossif