| Internet-Draft | Agentic Authority Graph Validation: A No | October 2026 |
| Watts | Expires 17 April 2027 | [Page] |
Agentic and delegated systems can represent authority as a graph whose paths terminate at consequential resources. Abstract graph models are useful, but interoperable validation requires a machine-readable representation and deterministic rules that do not accidentally accept vacuous or incomplete graphs. This document defines Agentic Authority Graph Validation (AAGV), a JSON interchange profile and validation algorithm for authority roots, consequential sinks, declared normal paths, revocation cut sets, and snapshot edge state. AAGV deliberately distinguishes structural cut validity from operational closure. It rejects missing sink sets, missing normal-path inventories, dangling references, non-dominating cuts, and non-revocable cut edges; it returns INDETERMINATE rather than CLOSED when relevant edge state is unknown. AAGV does not define an authorization token, discover hidden paths, or prove physical containment.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 17 April 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
Authorization and revocation mechanisms increasingly operate across delegated agents, exchanged credentials, queues, retries, services, and resource-side enforcement points. A graph abstraction can model these relationships, but a universal statement such as "every path crosses K" can be misleading if the graph omits its sinks or contains no declared normal path. A validator therefore needs explicit anti-vacuity rules in addition to ordinary reachability checks.¶
This document specifies a carrier-neutral JSON representation and deterministic validation procedure. Its strongest claim is intentionally narrow: given one declared graph snapshot, AAGV can determine whether the snapshot is structurally well-formed, whether each declared cut set disconnects all declared authority roots from all declared consequential sinks, and whether the snapshot contains an enabled path or relevant unknown state. It does not establish that the graph contains every real path in a deployment.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals.¶
A declared origin of authority whose prospective reachability is being analyzed.¶
A declared resource or commitment boundary at which a successful operation can create an externally relevant effect.¶
An explicitly declared root-to-sink path known to be valid in ordinary operation. Normal paths prevent a cut claim from succeeding only because no path was modeled.¶
A declared set of revocable edges whose removal is intended to disconnect every declared authority root from every declared consequential sink.¶
An edge with unknown snapshot state that is reachable from an authority root and whose destination can structurally reach a consequential sink.¶
An AAGV object MUST contain: a version, graph identifier, snapshot sequence, capture time, authority-epoch identifier, one or more roots, one or more sinks, node records, edge records, a non-empty normal-path inventory, and one or more revocation cut sets.¶
Each node has an identifier, a node kind, and a trust-domain label. Each edge has an identifier, source node, destination node, capability label, snapshot state, and enforcement metadata. Edge state is one of enabled, disabled, or unknown. Enforcement metadata declares whether the edge is revocable, the control domain, and a revocation identifier.¶
AAGV does not cryptographically prove that a stated trust domain is independent or that a revocation point is physically enforceable. Those are external assertions. AAGV only prevents such assertions from being silently omitted when a cut is evaluated.¶
A validator MUST reject an object as INVALID if the root set or sink set is empty; if the normal-path inventory is empty; if any listed sink lacks at least one contiguous declared normal path from a listed root; or if there is no structural root-to-sink path in the graph.¶
These requirements are deliberate. In classical logic, a universal statement over an empty path set can be true. AAGV does not allow such a vacuous truth to be promoted into a positive security result.¶
Validate the JSON object against the AAGV schema and reject duplicate identifiers.¶
Verify that every root, sink, edge endpoint, normal-path edge, and cut-set edge resolves to a declared object.¶
Verify each normal path for contiguity, declared root, and declared sink; require coverage of every listed sink.¶
Compute structural reachability from all roots to all sinks. If no sink is reachable, return INVALID.¶
For each cut set K, verify that every member edge is declared revocable, remove K, recompute reachability, and return INVALID if any listed sink remains reachable from any listed root.¶
Determine whether any unknown-state edge is relevant to a root-to-sink route. If so, return INDETERMINATE.¶
Compute reachability using enabled edges only. If any sink is reachable, return VALID_OPEN; otherwise return VALID_CLOSED.¶
VALID_CLOSED is a graph-snapshot result, not a claim of physical or deployment-wide revocation closure. A relying party MUST NOT describe VALID_CLOSED as proving absence of undeclared, hidden, future, or out-of-scope paths.¶
The object is malformed, vacuous, internally inconsistent, references nonexistent objects, includes a non-dominating cut, or otherwise fails a required structural rule.¶
The structure and cut are valid but relevant snapshot state is unknown. Unknown MUST NOT be treated as closed.¶
The structure and cuts are valid and at least one enabled root-to-sink path remains.¶
The structure and cuts are valid and no enabled root-to-sink path exists in this declared snapshot.¶
RFC 7009 defines OAuth token revocation but does not define authority-graph interchange. Token Exchange in RFC 8693 can create delegation relationships but does not define this graph profile.¶
The Revocation Closure and Boundary Jurisdiction Architecture Internet-Drafts define abstract authority graphs, consequential sinks, cut sets, and closure semantics. AAGV operationalizes only the interchange and deterministic snapshot-validation portion; it does not replace those semantics.¶
Actor-chain and agent-credential work can preserve delegation lineage. AAGV additionally represents non-credential components such as queues, enforcement edges, and commitment boundaries. Consequence-path-completeness work emphasizes alternate effect routes; AAGV provides a machine-checkable representation in which such bypass edges cause cut validation to fail.¶
This document does not claim invention of directed graphs, graph cuts, capability systems, revocation, delegation, or reachability analysis.¶
An implementation claiming AAGV-v0.1 conformance MUST reproduce the normative outcome for the published conformance vectors. The suite includes positive cases, missing-sink and missing-normal-path cases, a bypass around the cut, open and unknown snapshot states, dangling references, cycles, multiple roots, invalid cut references, malformed declared paths, and a non-revocable cut member.¶
The core falsifier is direct: if a graph accepted as structurally cut-valid contains any declared root-to-sink path after removal of the accepted cut, the validator is non-conformant. If it returns VALID_CLOSED while a relevant edge state is unknown, it is non-conformant.¶
AAGV is vulnerable to incomplete modeling. An attacker or operator can omit a bypass path and still produce a structurally valid snapshot. Consumers MUST therefore treat graph coverage as a separate assurance question.¶
Trust-domain and revocability labels are declarations. They require deployment evidence outside this format. AAGV validation MUST NOT be presented as proof of independent control, hardware isolation, physical containment, or absence of covert channels.¶
Unknown edge state is fail-closed for closure claims. Parsers MUST reject duplicate identifiers and dangling references. Implementations SHOULD bound input size and use reachability algorithms that do not enumerate every simple path, because cyclic graphs can have an exponential number of simple paths.¶
Authority graphs can reveal organizational topology, service relationships, delegation structure, resource names, and security-control placement. Producers SHOULD use scoped identifiers and disclose only the graph elements necessary for the relying party's analysis.¶
This document has no IANA actions.¶