\documentclass[sigconf,nonacm]{acmart}

\usepackage{amsmath,amssymb,amsthm}
\usepackage{booktabs}
\usepackage{listings}
\usepackage{xcolor}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{definition}{Definition}

\lstset{
  basicstyle=\ttfamily\small,
  keywordstyle=\color{blue},
  commentstyle=\color{gray},
  breaklines=true,
  frame=single,
  numbers=left,
  numberstyle=\tiny\color{gray}
}

\title{Faceted Authority Attenuation: A Product Lattice Model for AI Agent Governance}

\author{Tymofii Pidlisnyi}
\affiliation{%
  \institution{AEOESS}
  \city{Los Angeles}
  \state{California}
  \country{USA}
}
\email{signal@aeoess.com}

\begin{abstract}
As AI agents gain the ability to take real-world actions under delegated human authority,
governance systems must enforce that delegated capabilities can only be attenuated, never
amplified. Current implementations enforce this principle through ad hoc, per-dimension
checks---verifying scope inclusion, spend limits, and delegation depth independently.
We show that these heterogeneous constraints are instances of a single structural
principle: agent authority is an element of a product lattice, and delegation is a monotone
function on that lattice. We formalize this as \emph{faceted authority attenuation} over
seven constraint dimensions (scope, spend, depth, time, reputation, values, reversibility),
prove that the monotonic narrowing invariant holds over the product ordering, and
demonstrate that this formalization yields three concrete benefits unavailable to
scalar or ad hoc approaches: (1) structured, machine-readable denial diagnostics
that identify exactly which constraint dimensions failed and why, (2) cryptographically
signed authorization witnesses that capture an agent's position in the authority lattice
at execution time, and (3) near-miss detection that warns when an agent approaches
constraint boundaries before violation occurs. The formalization is implemented in the
Agent Passport System (first published to npm February 2026), an open-source protocol
with 1,634 tests across 85 modules, validated through cross-protocol composition tests
with five independent working group members on production infrastructure.
\end{abstract}

\keywords{AI agent governance, capability attenuation, lattice-based access control,
delegation, authorization, multi-agent systems}

\begin{document}
\maketitle

\section{Introduction}

The deployment of LLM-based agents capable of executing code, making purchases, sending
messages, and coordinating with other agents creates a class of authorization problems
that existing access control frameworks were not designed to handle. Unlike traditional
software principals, LLM agents are non-deterministic, prompt-sensitive, and capable of
generating novel action sequences that were never explicitly programmed.

The principle of least privilege~\cite{saltzer1975} and capability-based
security~\cite{dennis1966} established that delegated capabilities should be attenuatable
but not amplifiable. Miller~\cite{miller2006} formalized this as capability attenuation:
a reference holder cannot confer rights to another that the holder does not possess.

In practice, agent governance systems enforce attenuation through multiple independent
checks: is the requested scope a subset of the delegated scope? Does the requested spend
exceed the limit? Is the delegation depth within bounds? Each check is implemented
separately, producing separate error messages, with no formal relationship between them.

This paper makes the following observation: these heterogeneous checks are not independent
properties. They are projections of a single structural principle onto different constraint
dimensions. Agent authority is an element of a product lattice, and delegation is a monotone
function on that lattice.

This observation is mathematically straightforward---product lattices over ordered sets
are standard constructions. The contribution is not the mathematics itself but the
identification that LLM agent governance constraints form such a lattice, and the
demonstration that recognizing this structure yields concrete operational benefits that
ad hoc implementations miss.

\paragraph{Contributions.}
\begin{enumerate}
\item We identify seven constraint dimensions of LLM agent authority and prove they form
      a product lattice with delegation as a monotone function.
\item We define three protocol artifacts enabled by the lattice structure:
      \emph{AuthorizationWitness}, \emph{ConstraintVector}, and \emph{ConstraintFailure}.
\item We present four case studies where faceted narrowing catches violations that
      single-dimensional or scalar authorization misses, including institutional-scale
      governance where charters gate offices that gate delegations that gate actions.
\item We provide an open-source implementation with 1,634 tests across 85 modules,
      validated through cross-protocol composition with five independent implementations.
\end{enumerate}

\paragraph{Scope and claims.} This paper presents a useful formalization for agent
governance, not a novel mathematical construction. We do not claim that product lattices
are new. We claim that recognizing agent authority \emph{as} a product lattice, and
building protocol artifacts that exploit this structure, yields measurable improvements
in denial diagnostics, forensic verifiability, and proactive safety monitoring.

\paragraph{Prior publication.} An earlier version of the underlying protocol was published
as ``Monotonic Narrowing for Agent Authority''~\cite{aeoess2026} with three constraint
dimensions and a scalar formulation. The present paper generalizes to seven dimensions,
proves the product lattice structure, and introduces the three protocol artifacts.
The Agent Passport System SDK was first published to npm on February 22, 2026 (v1.0.0).
The monotonic narrowing paper was published on Zenodo on March 10, 2026
(DOI:10.5281/zenodo.18932404). All commit history is publicly verifiable at
\url{https://github.com/aeoess/agent-passport-system}.

\section{Background}

\subsection{Capability Attenuation}

Dennis and Van Horn~\cite{dennis1966} introduced capability-based addressing, where
access rights are bound to unforgeable tokens. Miller~\cite{miller2006} refined this
into the capability attenuation principle. The Agent Passport System~\cite{aeoess2026}
applies this to AI agent delegation chains with Ed25519 cryptographic enforcement.
The initial formulation specified attenuation as three independent conditions:
\begin{align}
\text{scope}(d_{i+1}) &\subseteq \text{scope}(d_i) \label{eq:scope} \\
\text{spendLimit}(d_{i+1}) &\leq \text{spendLimit}(d_i) \label{eq:spend} \\
\text{depth}(d_{i+1}) &< \text{depth}(d_i) \label{eq:depth}
\end{align}

\subsection{Lattice-Based Access Control}

Denning~\cite{denning1976} showed that information flow security can be modeled as a
lattice. Bell and LaPadula~\cite{bell1973} formalized this for confidentiality.
Sandhu~\cite{sandhu1993} extended lattice models to role-based access control. Our
authority space is structurally identical to Denning's security lattice, with agent
authority replacing security clearance and delegation replacing information flow. The
key difference: Denning's lattice has two dimensions. Our authority lattice has seven.

\subsection{Abstract Interpretation}

Cousot and Cousot~\cite{cousot1977} introduced abstract interpretation as a framework
for sound program analysis. Gateway constraint checking in our system can be understood
through this lens. The concrete domain is the set of all possible agent actions. The
abstract domain is the authority lattice. The abstraction function $\alpha$ maps an
action to the minimum authority element required. The check
$\alpha(\text{action}) \leq_A \text{auth}(\text{agent})$ is a sound abstract
interpretation: if it passes, the action is within the principal's intended authority.

\subsection{Concurrent Agent Authorization Work}

Multiple concurrent efforts address agent identity and delegation, validating the problem
space while differing in approach.

Kumar~\cite{mishra2026} proposes the Delegated Agent Authorization Protocol (DAAP) as an
OAuth~2.0 extension with scope subsetting, cascade revocation, and budget controls.
DAAP's invariants correspond directly to our scope, spend, and depth dimensions but are
specified as independent conditions rather than a unified lattice.

Prakash~\cite{prakash2026} proposes the Agent Identity Protocol (AIP) using
Invocation-Bound Capability Tokens (IBCTs) with scope attenuation and completion blocks.
AIP claims that ``no prior implemented protocol jointly combines public-key verifiable
delegation, holder-side attenuation, expressive chained policy, transport bindings, and
provenance-oriented completion records.'' However, the Agent Passport System---first
published to npm on February~22,~2026 and to Zenodo on March~10,~2026---provides all
five properties: Ed25519 verifiable delegation, monotonic scope narrowing (holder-side
attenuation), a three-signature policy chain (intent, evaluation, receipt), a 120-tool
MCP server (transport binding), and signed ActionReceipts (provenance records). AIP uses
JWT/Biscuit tokens; APS uses Ed25519-signed canonical JSON. AIP was published on
March~25,~2026.

The independent convergence of APS, DAAP, and AIP on scope attenuation as the core
delegation constraint---from three different starting points (raw Ed25519, OAuth~2.0, and
Biscuit tokens respectively)---provides evidence that this property is a fundamental
requirement for agent delegation, not a design choice specific to any one system. The
present paper's contribution is the recognition that these constraints form a product
lattice, enabling the protocol artifacts described in Section~4.

\section{Faceted Authority Attenuation}

\subsection{Authority Dimensions}

\begin{definition}[Authority Space]
An authority space is a product of $n$ partially ordered sets (lattices):
$A = D_1 \times D_2 \times \cdots \times D_n$
where each $D_k$ is a bounded lattice with meet operation $\sqcap_k$,
top element $\top_k$, and bottom element $\bot_k$.
\end{definition}

For the Agent Passport System, $n = 7$:

\begin{table}[h]
\caption{Authority Dimensions}
\label{tab:dimensions}
\begin{tabular}{@{}llll@{}}
\toprule
Dimension & Lattice & $\top$ & $\bot$ \\
\midrule
Scope & $(\mathcal{P}(S), \subseteq)$ & $S$ & $\emptyset$ \\
Spend & $(\mathbb{R}_{\geq 0}, \leq)$ & $\infty$ & $0$ \\
Depth & $(\mathbb{N}, \leq)$ & max & $0$ \\
Time & $([0,\infty), \leq)$ & $\infty$ & $0$ \\
Reputation & $([0,100], \leq)$ & $100$ & $0$ \\
Values & $(\mathcal{P}(V), \subseteq)$ & $V$ & $\emptyset$ \\
Reversibility & $(\{T,C,I\}, \leq)$ & $I$ & $T$ \\
\bottomrule
\end{tabular}
\end{table}

The reversibility dimension captures action permanence: $T$ (tentative, fully reversible),
$C$ (compensable, reversible with cost), $I$ (irreversible). The ordering $T \leq C \leq I$
means an agent authorized for irreversible actions can perform tentative ones, but not
vice versa.

\begin{definition}[Product Lattice Ordering]
The product ordering $\leq_A$ is defined componentwise:
$a \leq_A b \iff \forall k \in [1,n]: a_k \leq_k b_k$.
Two elements may be incomparable if one exceeds the other in some dimensions but not all.
\end{definition}

\begin{definition}[Delegation as Monotone Function]
A delegation function $\delta: A \to A$ is monotone if:
$\forall a \in A: \delta(a) \leq_A a$.
\end{definition}

\subsection{The Narrowing Theorem}

\begin{theorem}[Faceted Monotonic Narrowing]
For any delegation chain $d_1, d_2, \ldots, d_k$, where $\delta_i$ is the delegation
function producing $d_{i+1}$ from $d_i$:
\[
\text{auth}(d_k) \leq_A \text{auth}(d_{k-1}) \leq_A \cdots \leq_A \text{auth}(d_1)
\]
Authority monotonically narrows along the chain in the product lattice ordering.
\end{theorem}

\begin{proof}
Each $\delta_i$ is monotone by Definition~3. The composition of monotone functions
on a partially ordered set is monotone: if $\delta_i(a) \leq_A a$ and
$\delta_{i+1}(\delta_i(a)) \leq_A \delta_i(a)$, then by transitivity of $\leq_A$,
$\delta_{i+1}(\delta_i(a)) \leq_A a$. By induction on chain length, the transitive
closure of delegation is monotone. \qed
\end{proof}

\begin{corollary}[Independent Facet Narrowing]
Each dimension narrows independently:
$\forall k: \text{auth}_k(d_{i+1}) \leq_k \text{auth}_k(d_i)$.
The original three-condition formulation (Equations~\ref{eq:scope}--\ref{eq:depth})
is a special case with $n=3$.
\end{corollary}

\begin{corollary}[Effective Authority as Meet]
The effective authority of an agent with multiple active delegations is:
$\text{effectiveAuth}(\text{agent}) = \bigcap_{d \in \text{delegations}(\text{agent})} \text{auth}(d)$.
An agent cannot claim authority from one delegation to exceed limits imposed by another.
\end{corollary}

\section{Protocol Artifacts}

The lattice structure enables three protocol artifacts that ad hoc implementations
cannot produce.

\subsection{ConstraintVector: Runtime Lattice Evaluation}

A ConstraintVector is the runtime representation of authority evaluation over the product
lattice. Each entry corresponds to one dimension $D_k$:

\begin{lstlisting}[language=Java,caption=ConstraintVector type]
interface ConstraintEvaluation {
  facet: ConstraintFacet    // which dimension
  status: ConstraintStatus  // pass|fail|unknown
  headroom?: number|string  // distance from boundary
  failure?: ConstraintFailure
}
\end{lstlisting}

The \texttt{status} field maps to the lattice comparison:
\texttt{pass} means $\text{auth}_k(\text{action}) \leq_k \text{auth}_k(\text{agent})$;
\texttt{fail} means the action exceeds authority in dimension $k$;
\texttt{unknown} means insufficient evidence to evaluate.

\subsection{AuthorizationWitness: Signed Lattice Position}

An AuthorizationWitness is a cryptographically signed snapshot of the agent's position
in the authority lattice at the moment of execution:

\begin{lstlisting}[language=Java,caption=AuthorizationWitness type]
interface AuthorizationWitness {
  delegationId: string
  agentId: string
  constraints: ConstraintEvaluation[]
  primaryFailure?: ConstraintFacet
  timestamp: string
  gatewaySignature: string // Ed25519
}
\end{lstlisting}

The witness is generated by the enforcement gateway (not self-reported by the agent),
creating a cryptographic record of \emph{where} in the authority lattice the agent was
positioned when the action was evaluated.

\subsection{ConstraintFailure: Structured Denial}

\begin{lstlisting}[language=Java,caption=ConstraintFailure type]
interface ConstraintFailure {
  facet: ConstraintFacet
  limit: string | number
  actual: string | number
  primaryFailure: boolean
}
\end{lstlisting}

\section{Comparative Evaluation}

We present four scenarios where faceted narrowing catches violations that scalar or
single-dimensional authorization misses.

\subsection{Case 1: Time-Spend Dual Expiry}

\paragraph{Scenario.} An agent holds a delegation with \$500 spend limit and 24-hour TTL.
At hour 20, the agent has spent \$450 and requests a \$30 action.

\paragraph{Scalar result.} Each check passes independently. The delegation expires mid-execution.

\paragraph{Faceted result.} The ConstraintVector evaluates all dimensions simultaneously.
The \texttt{time} facet shows headroom of 4 hours, but near-miss alert fires because
the headroom-to-execution-time ratio is below threshold.

\paragraph{What the lattice provides.} The product structure makes the interaction between
dimensions visible. A scalar system cannot express ``within budget but temporally fragile.''

\subsection{Case 2: Reputation-Gated Scope Interaction}

\paragraph{Scenario.} An agent has delegation scope \texttt{[finance:read, finance:write]}
and a reputation score of 45 (Operator tier, max spend \$100). It requests a
\texttt{finance:write} action costing \$80.

\paragraph{Scalar result.} Scope: pass. Spend: pass. Action proceeds without surfacing
that the reputation tier caps effective spend at \$100.

\paragraph{Faceted result.} The ConstraintVector shows reputation as the binding constraint
with only \$20 headroom against tier limit.

\paragraph{What the lattice provides.} The effective authority is the meet:
$\text{effectiveSpend} = \min(\text{delegationLimit}, \text{tierLimit})$.

\subsection{Case 3: Values-Reversibility Interaction}

\paragraph{Scenario.} An agent attests to all seven values floor principles including
F-003 (proportionality). It requests an irreversible action within scope and spend limits.

\paragraph{Scalar result.} Scope: pass. Spend: pass. Values: all attested. Action proceeds.

\paragraph{Faceted result.} The ConstraintVector evaluates \texttt{reversibility}
and \texttt{values} dimensions. The cross-dimensional interaction triggers escalation.

\paragraph{What the lattice provides.} The interaction between values and reversibility
is visible only in the product structure.

\subsection{Case 4: Institutional Lattice Composition}

\paragraph{Scenario.} An organization creates an InstitutionalCharter defining governance
rules. An office holder (Treasurer) creates a delegation to an agent with scope
\texttt{[finance:*]} and \$10{,}000 spend limit. That agent sub-delegates to a specialist
with scope \texttt{[finance:procurement]} and \$2{,}000. The specialist requests a
\$1{,}500 purchase.

\paragraph{Scalar result.} Each layer checks independently. Three passing checks, no
unified view.

\paragraph{Faceted result.} The ConstraintVector traces authority through four composition
levels: charter $\to$ office $\to$ delegation $\to$ sub-delegation. Each level narrows in
the product lattice. The AuthorizationWitness captures the full chain with
\texttt{scope} narrowed from \texttt{[*]} to \texttt{[finance:*]} to
\texttt{[finance:procurement]}, \texttt{spend} narrowed from unlimited to \$10{,}000 to
\$2{,}000, and \texttt{depth} decremented at each level.

\paragraph{What the lattice provides.} Institutional governance is not a separate system
bolted onto agent delegation---it is the same product lattice operating at a higher
composition level. The charter constrains offices. Offices constrain delegations.
Delegations constrain actions. The narrowing theorem (Theorem~1) guarantees that authority
attenuates across all four levels simultaneously, across all seven dimensions. No
institutional participant can exceed the authority granted by the level above it.

This case study uses the Rome-Complete institutional layer shipped in APS v1.27.0,
which provides InstitutionalCharter, OfficeRegistry, ApprovalPolicy, SuccessionEngine,
and Federation primitives---all enforcing the same product lattice constraints.

\section{Implementation and Validation}

The model is implemented in the Agent Passport System (APS), an open-source cryptographic
governance protocol first published to npm on February~22,~2026.

\paragraph{Current state (March~27,~2026).} SDK v1.27.0: 1,634 tests, 421 suites,
85 modules (53 core + 32 constitutional governance). Published on npm
(\texttt{agent-passport-system}), PyPI (\texttt{agent-passport-system}, v0.7.0), and
Zenodo (DOI:10.5281/zenodo.18749779). MCP server v2.16.0 with 120 tools
(\texttt{agent-passport-system-mcp}). Approximately 9{,}000 npm downloads in the first
month. Apache-2.0 license.

The ProxyGateway evaluates every action request against the full ConstraintVector.
Denials produce ConstraintFailure with dimensional diagnostics. Approvals produce
signed AuthorizationWitness. Near-miss alerting tracks headroom across all constraint
dimensions and generates proactive warnings before any violation occurs.

\paragraph{Cross-protocol validation.} The implementation was validated through a live
cross-protocol composition test (Campaign~7) with five independent working group members:
qntm (encrypted transport, Go), AgentID (CA-issued identity, Python), OATR (trust
registry, Node.js), ArkForge (execution attestation), and APS (governance, TypeScript).
APS governance artifacts were verified through three independently ratified specifications
(QSP-1 encrypted transport, DID Resolution~v1.0, Entity Verification~v1.0) on production
infrastructure. Two independent APS SDK implementations (TypeScript, Python) completed the
same composition test.

\paragraph{Publication timeline.}
\begin{itemize}
\item February~18,~2026: Protocol development started.
\item February~22,~2026: First npm publish (v1.0.0).
\item March~10,~2026: Monotonic narrowing paper on Zenodo (DOI:10.5281/zenodo.18932404).
\item March~19,~2026: Constraint architecture with ConstraintVector and
      AuthorizationWitness shipped (v1.21.x).
\item March~24,~2026: Working group ratifies Entity Verification v1.0 (4/4 unanimous).
\item March~27,~2026: Rome-Complete institutional layer shipped (v1.27.0, 1,634 tests).
\end{itemize}

\section{Limitations}

\begin{enumerate}
\item The mathematical construction (product lattices over ordered sets) is standard.
      The contribution is the domain mapping and the protocol artifacts.
\item The seven dimensions are not proven to be exhaustive.
\item The \texttt{unknown} constraint status extends the model beyond classical
      lattice theory. A full treatment using Belnap's four-valued logic~\cite{belnap1977}
      is deferred to future work.
\item The formalization does not address the semantic gap between authorized
      action categories and their real-world effects.
\item Evaluation is primarily self-referential. Cross-protocol testing addresses
      this partially.
\item Near-miss alerting thresholds are operator-configured.
\end{enumerate}

\section{Conclusion}

We formalized agent authority as a product lattice and delegation as monotone attenuation
over seven constraint dimensions. This formalization is not mathematically novel---it
applies standard constructions from lattice theory and abstract interpretation to a
new domain. The value lies in three concrete protocol artifacts that the lattice
structure enables: authorization witnesses that capture an agent's lattice position at
execution time, constraint vectors that make cross-dimensional interactions visible,
and structured denials that identify exactly which dimensions failed and why.

The formalization extends from individual agent delegation to institutional governance,
with charters, offices, and delegations all operating within the same product lattice
(Case Study~4). The independent convergence of three concurrent efforts---APS, DAAP, and
AIP---on scope attenuation as the core delegation constraint provides evidence that
monotonic narrowing is a fundamental requirement for agent governance, not a design
choice specific to any one system.

All code, tests, and specifications are available at
\url{https://github.com/aeoess/agent-passport-system} under Apache-2.0.

\bibliographystyle{ACM-Reference-Format}
\begin{thebibliography}{14}

\bibitem{aeoess2026}
T.~Pidlisnyi. 2026. Monotonic Narrowing for Agent Authority: Formal Invariants,
Adversarial Testing, and Open Problems for Autonomous AI Systems.
Zenodo. DOI:10.5281/zenodo.18932404. First npm publish: February~22,~2026.

\bibitem{belnap1977}
N.~Belnap. 1977. A useful four-valued logic.
In \emph{Modern Uses of Multiple-Valued Logic}. Springer, 5--37.

\bibitem{bell1973}
D.~Bell, L.~LaPadula. 1973. Secure Computer Systems: Mathematical Foundations.
MITRE Technical Report 2547.

\bibitem{cousot1977}
Patrick Cousot and Radhia Cousot. 1977. Abstract Interpretation: A Unified Lattice
Model for Static Analysis of Programs. In \emph{POPL '77}. ACM, 238--252.

\bibitem{denning1976}
Dorothy E. Denning. 1976. A Lattice Model of Secure Information Flow. \emph{Commun. ACM}
19, 5, 236--243.

\bibitem{dennis1966}
Jack B. Dennis and Earl C. Van Horn. 1966. Programming Semantics for Multiprogrammed
Computations. \emph{Commun. ACM} 9, 3, 143--155.

\bibitem{miller2006}
Mark S. Miller. 2006. \emph{Robust Composition: Towards a Unified Approach to Access
Control and Concurrency Control}. Ph.D. Dissertation. Johns Hopkins University.

\bibitem{mishra2026}
Sanjeev Mishra. 2026. Delegated Agent Authorization Protocol.
Internet-Draft draft-mishra-oauth-agent-grants-01. IETF.

\bibitem{nist2023}
NIST. 2023. AI Risk Management Framework (AI RMF 1.0). NIST AI 100-1.

\bibitem{owasp2024}
OWASP. 2024. AI Vulnerability Scoring System (AIVSS).

\bibitem{prakash2026}
Sunil Prakash. 2026. AIP: Agent Identity Protocol for Verifiable Delegation Across
MCP and A2A. arXiv:2603.24775. Submitted March~25,~2026.

\bibitem{prakash2026b}
Sunil Prakash. 2026. Agent Identity Protocol (AIP): Verifiable Delegation for AI
Agent Systems. Internet-Draft draft-prakash-aip-00. IETF. March~27,~2026.

\bibitem{saltzer1975}
Jerome H. Saltzer and Michael D. Schroeder. 1975. The Protection of Information in
Computer Systems. \emph{Proceedings of the IEEE} 63, 9, 1278--1308.

\bibitem{sandhu1993}
Ravi S. Sandhu. 1993. Lattice-Based Access Control Models. \emph{Computer} 26, 11, 9--19.

\end{thebibliography}

\end{document}
