The five invariants

Subact ID keeps five rules everywhere:

1. The subject is always the human. The agent appears in the token’s act claim, never in sub. This is delegation, not impersonation.
2. Scope only narrows. At issue and at refresh, the scope is never wider than what the task already holds. v0.1 issues depth 1 only, so there are no further hops.
3. A token never outlives its task. Each token expires no later than the task it belongs to.
4. Every authorization decision is recorded, including every denial.
5. No secret is ever logged, returned in an error, or committed.

Note

The conformance suite tests these rules against a running instance, through its public endpoints only.