Scopes and approvals: bind authority to the exact reviewed effect
Separate credentials, scoped capabilities, approval receipts, artifact identity, and revocation timing in a proposed execution gate.
On this page
The question for today
What you’ll understand
- Compute the intersection of delegated action and resource scopes.
- Bind approval to canonical arguments and the intended artifact version.
- Define an enforceable authorization decision point and revocation policy.
A credential proves something about a caller, while a capability or policy grants specific actions. A human approval can authorize one reviewed effect within that scope. None of these should be replaced by a model's statement that an action is allowed. Define their intersection at the execution boundary and preserve the exact artifact and arguments that were approved.
Authority narrows through explicit scope checks
Represent allowed actions, resources, tenant, audience, expiry, and quantitative limits according to the application's actual authorization system. A delegated grant should not exceed the delegator's scope under the proposed policy. Intersect requested and permitted resources rather than trusting a model-supplied tenant or role. MCP's 2025-06-18 authorization specification and OAuth resource indicators describe concrete token and resource protections; they do not define every application's human-approval workflow or substitute for tool-level authorization.
Validate the intended recipient and resource of a credential, and avoid forwarding a token as though it were valid for every downstream service. A request can be well typed while exceeding scope. Tool output or retrieved text cannot grant a new capability merely by asking the agent to act. Keep authority decisions in trusted application state and include the required policy version or authoritative check. A cached permission result needs a freshness and revocation contract, especially for delayed or resumed runs.
Approval must name what the reviewer actually saw
A proposed approval receipt can bind principal, logical effect identity, canonical arguments, target resource and version, tool contract version, reviewed artifact digest, limits, expiry, and policy context. If a generated file or destination changes after review, its old receipt does not automatically authorize the changed effect. A hash helps compare the artifact when canonicalization and storage are trustworthy; it is not itself permission. Preserve a reviewable human description alongside machine identity so the receipt's meaning is auditable.
State whether approval covers one logical effect and its authorized retries or only one attempt. Requiring another approval for every transport retry can be unnecessary, while treating one approval as unlimited future authority is unsafe. Recheck current capability and revocation at the declared decision point. A revocation after a remote commit cannot erase the completed effect; preventing a dispatch or commit race requires actual synchronization or provider support. Expiry and policy logs alone do not create that atomicity.
Test changed identities and delayed execution
Test a changed destination, modified artifact, altered amount, expired receipt, revoked role, wrong audience, new incarnation, and a retry of the same logical effect. Verify which changes require a new review and which remain within the original explicit grant. Include compensation and cleanup paths because they may need separate limited capabilities. A runtime should explain the concrete missing predicate rather than silently broaden scope or repeatedly ask for approval when the exact authorized effect and policy remain valid.
The probability lab is only an all-checks calculation under artificial independence. Reset, set p=1 and n=3, predict all three successes with probability one, then Play or Step. Separately Reset, set p=0.90 and n=3, predict all-success probability 0.729, then Play or Step. There is no credential, approval, or access policy in the instrument. Actual execution checks are enforced predicates rather than random permission votes; the analogy only distinguishes each-check reliability from the whole-path condition being tested.
Work it through
Intersect a delegated grant before using a receipt
A parent grant permits actions {read,write} on resources {A,B,C}. A delegated request asks for {write,delete} on {B,D}. Its matching proposed approval expires at minute sixty, and the current decision time is minute forty-five.
The effective action set is {write}; delete is outside the parent grant.
The effective resource set is {B}; D is not authorized by the parent scope.
At minute forty-five, fifteen minutes remain before expiry. Only the exact reviewed write to B can pass these stated checks; at minute sixty-one the receipt is expired by one minute, regardless of unchanged JSON shape.
The intersection permits one action on one resource within the receipt's declared window, subject to the remaining identity and current-policy checks.
The living notebook
Explore the model
Interactive lab · probability
A whole path requires every declared check
Reset, set p=1 and n=3, predict P(K=3)=1, then Play or Step. Separately Reset, set p=0.90 and n=3, predict P(K=3)=0.9³=0.729, then Play or Step. The exact iid binomial has no authorization, approval receipts, or revocation mechanism.
- Mean · np
- 5
- Variance · np(1−p)
- 2.5
- Total probability
- 1
These are exact binomial probabilities for independent trials with one fixed success probability. Playback tours the distribution; it does not resample outcomes. Parameter changes pause playback and recompute the model at the current elapsed time. Reset restores both parameters and returns time to zero. Playback starts paused. Adjust either parameter, then choose Play or Step.
Look forEnforce every actual predicate; an average success rate cannot grant authority.
Pause & reason
Check your understanding
Your turn
Try it yourself
A capability allows at most ten units, an approval allows six, and the current unreserved budget has four. Under a proposed minimum-of-limits gate, what is the largest allowed new request? Does a five-unit request pass?
Take a moment to make a prediction or work it out on paper. Open a hint when you need one.
Give me a hint
All three independent upper bounds apply.
Compare with the solution
The maximum is min(10,6,4)=4 units. A five-unit request fails the current budget condition even though it fits the capability and approval bounds. These are separate checks and require atomic reservation if concurrent requests share the budget.
Keep the idea
Take it with you
- Credentials, scopes, approvals, and budgets are different authority conditions.
- Bind approval to the exact reviewed artifact and logical effect.
- Revocation timing needs an implemented decision and commit protocol.
Read further
Original sources and deeper explanations to follow at your own pace.
Optional progress, saved in this browser when available. Revisit any lesson at any time.
Lesson not marked complete.