Agent Permission Lab / 02
Permission is a
moving target.
A token can be valid.
The action can still be wrong.
Break an agent’s authority at the boundary between a decision and a side effect. Inspect what the system knew, when it knew it, and what actually happened.
Open the workbench ↓Edit the permission envelope 5 parameters
Changes reset the trace. Logical time starts at grant issuance. Amounts are whole synthetic pounds.
Execution trace Logical time
Decision evidence Select an event
Every event retains a snapshot. Select a trace row to inspect the state at that moment.
Request envelope
No request yet.
Run the same faults against every design
A check is not a transaction.
Each cell runs the same engine with the current envelope. “Preserved” means no modelled invariant was violated, not a security certification. A rejection at enqueue can also preserve an invariant.
| Experiment | Task-start | Preflight | Atomic |
|---|---|---|---|
| Run the suite to calculate all 27 experiments. | |||
Implementation contract
Put the boundary
where the write lives.
The atomic design assumes one authoritative transaction can evaluate authority, validate approved intent, reserve budget and record the effect. It is a model of a contract your backend must implement.
If payment happens in an external provider, a local database transaction alone cannot enforce that whole contract. Define provider idempotency, outbox delivery, reconciliation and the point beyond which revocation can no longer cancel the action.
transaction(authority, budget, ledger) {
if (ledger.has(intent.key))
return previous_result;
require(delegation_is_attenuated);
require(audience_and_scope_match);
require(now < grant.expires_at);
require(!authority.revoked);
require(payload == approved_intent);
require(budget.remaining >= amount);
budget.reserve(amount);
ledger.write(intent.key, effect);
} // one simulated linearisation pointRead the assumptions before the result.
What the engine actually models
Ordered events and interleavings; a two-hop delegation chain; scope, resource and audience constraints; grant expiry; authoritative versus delayed replica state; intent binding; shared budget; duplicate delivery. The trace is reproducible. Its times are inputs, not latency measurements.
What it does not implement
No signed tokens, OAuth server, cryptographic identity, clock skew, real database locks, network partitions, crash recovery or external payment system. The in-memory atomic operation represents serialisation, not a distributed implementation. No LLM reasoning is simulated.
Why an event can be allowed and still violate an invariant
The cached and preflight designs intentionally reuse an earlier decision. At a successful write the lab independently evaluates current authoritative constraints and approved intent, and checks for duplicate effects. That independent oracle labels unsafe writes. In the evidence panel, write-event checks for those designs show this oracle, not checks their enforcement actually performed.
What to test in a real implementation
Revoke every ancestor grant; vary replication lag and token lifetime; mutate approval-bound fields; replay the same key with the same and different payloads; race two workers against a shared budget; crash between provider success and acknowledgement. Assert ledger invariants and valid-control completion, then document the exact cancellation boundary.