Skip to main content

ADR-0115: Context Authority and delegation intersection rule

Context​

Kit section 7 and final absolute rule.

Decision​

The Context Authority issues and verifies a signed execution context (/v1/context/issue, /verify, JWKS). Effective rights are the intersection of user, agent and delegation (/v1/delegations/authorize); a subagent gains no right.

Consequences​

Mandates for scheduled agents, break-glass with expiry.

Evidence​

  • services/control-plane/src/eai/domains/context/authority.py
  • services/control-plane/src/eai/domains/delegation/runtime.py
  • services/control-plane/src/eai/domains/delegation/service.py
  • sql/postgres/V115__context_authority.sql
  • sql/postgres/V116__delegations.sql
  • sql/postgres/V117__agent_mandates.sql
  • sql/postgres/V118__break_glass.sql
  • services/control-plane/tests/test_identity_context_delegation.py