Agentic Authority Graph Validation: A Non-Vacuous Interchange Profile for Revocation-Cut Analysis

Introduction Authorization and revocation mechanisms increasingly operate across delegated agents, exchanged credentials, queues, retries, services, and resource-side enforcement points. A graph abstraction can model these relationships, but a universal statement such as "every path crosses K" can be misleading if the graph omits its sinks or contains no declared normal path. A validator therefore needs explicit anti-vacuity rules in addition to ordinary reachability checks. This document specifies a carrier-neutral JSON representation and deterministic validation procedure. Its strongest claim is intentionally narrow: given one declared graph snapshot, AAGV can determine whether the snapshot is structurally well-formed, whether each declared cut set disconnects all declared authority roots from all declared consequential sinks, and whether the snapshot contains an enabled path or relevant unknown state. It does not establish that the graph contains every real path in a deployment.

Requirements LanguageThe key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals.

Terminology

Authority Root: A declared origin of authority whose prospective reachability is being analyzed.
Consequential Sink: A declared resource or commitment boundary at which a successful operation can create an externally relevant effect.
Normal Path: An explicitly declared root-to-sink path known to be valid in ordinary operation. Normal paths prevent a cut claim from succeeding only because no path was modeled.
Revocation Cut Set: A declared set of revocable edges whose removal is intended to disconnect every declared authority root from every declared consequential sink.
Relevant Unknown Edge: An edge with unknown snapshot state that is reachable from an authority root and whose destination can structurally reach a consequential sink.

AAGV JSON Model An AAGV object MUST contain: a version, graph identifier, snapshot sequence, capture time, authority-epoch identifier, one or more roots, one or more sinks, node records, edge records, a non-empty normal-path inventory, and one or more revocation cut sets. Each node has an identifier, a node kind, and a trust-domain label. Each edge has an identifier, source node, destination node, capability label, snapshot state, and enforcement metadata. Edge state is one of enabled, disabled, or unknown. Enforcement metadata declares whether the edge is revocable, the control domain, and a revocation identifier. AAGV does not cryptographically prove that a stated trust domain is independent or that a revocation point is physically enforceable. Those are external assertions. AAGV only prevents such assertions from being silently omitted when a cut is evaluated.

Anti-Vacuity Rules A validator MUST reject an object as INVALID if the root set or sink set is empty; if the normal-path inventory is empty; if any listed sink lacks at least one contiguous declared normal path from a listed root; or if there is no structural root-to-sink path in the graph. These requirements are deliberate. In classical logic, a universal statement over an empty path set can be true. AAGV does not allow such a vacuous truth to be promoted into a positive security result.

Deterministic Validation Algorithm

Validate the JSON object against the AAGV schema and reject duplicate identifiers.
Verify that every root, sink, edge endpoint, normal-path edge, and cut-set edge resolves to a declared object.
Verify each normal path for contiguity, declared root, and declared sink; require coverage of every listed sink.
Compute structural reachability from all roots to all sinks. If no sink is reachable, return INVALID.
For each cut set K, verify that every member edge is declared revocable, remove K, recompute reachability, and return INVALID if any listed sink remains reachable from any listed root.
Determine whether any unknown-state edge is relevant to a root-to-sink route. If so, return INDETERMINATE.
Compute reachability using enabled edges only. If any sink is reachable, return VALID_OPEN; otherwise return VALID_CLOSED.

VALID_CLOSED is a graph-snapshot result, not a claim of physical or deployment-wide revocation closure. A relying party MUST NOT describe VALID_CLOSED as proving absence of undeclared, hidden, future, or out-of-scope paths.

Outcome Semantics

INVALID: The object is malformed, vacuous, internally inconsistent, references nonexistent objects, includes a non-dominating cut, or otherwise fails a required structural rule.
INDETERMINATE: The structure and cut are valid but relevant snapshot state is unknown. Unknown MUST NOT be treated as closed.
VALID_OPEN: The structure and cuts are valid and at least one enabled root-to-sink path remains.
VALID_CLOSED: The structure and cuts are valid and no enabled root-to-sink path exists in this declared snapshot.

Relationship to Existing Work RFC 7009 defines OAuth token revocation but does not define authority-graph interchange. Token Exchange in RFC 8693 can create delegation relationships but does not define this graph profile. The Revocation Closure and Boundary Jurisdiction Architecture Internet-Drafts define abstract authority graphs, consequential sinks, cut sets, and closure semantics. AAGV operationalizes only the interchange and deterministic snapshot-validation portion; it does not replace those semantics. Actor-chain and agent-credential work can preserve delegation lineage. AAGV additionally represents non-credential components such as queues, enforcement edges, and commitment boundaries. Consequence-path-completeness work emphasizes alternate effect routes; AAGV provides a machine-checkable representation in which such bypass edges cause cut validation to fail. This document does not claim invention of directed graphs, graph cuts, capability systems, revocation, delegation, or reachability analysis.

Conformance and Falsification An implementation claiming AAGV-v0.1 conformance MUST reproduce the normative outcome for the published conformance vectors. The suite includes positive cases, missing-sink and missing-normal-path cases, a bypass around the cut, open and unknown snapshot states, dangling references, cycles, multiple roots, invalid cut references, malformed declared paths, and a non-revocable cut member. The core falsifier is direct: if a graph accepted as structurally cut-valid contains any declared root-to-sink path after removal of the accepted cut, the validator is non-conformant. If it returns VALID_CLOSED while a relevant edge state is unknown, it is non-conformant.

Security Considerations AAGV is vulnerable to incomplete modeling. An attacker or operator can omit a bypass path and still produce a structurally valid snapshot. Consumers MUST therefore treat graph coverage as a separate assurance question. Trust-domain and revocability labels are declarations. They require deployment evidence outside this format. AAGV validation MUST NOT be presented as proof of independent control, hardware isolation, physical containment, or absence of covert channels. Unknown edge state is fail-closed for closure claims. Parsers MUST reject duplicate identifiers and dangling references. Implementations SHOULD bound input size and use reachability algorithms that do not enumerate every simple path, because cyclic graphs can have an exponential number of simple paths.

Privacy ConsiderationsAuthority graphs can reveal organizational topology, service relationships, delegation structure, resource names, and security-control placement. Producers SHOULD use scoped identifiers and disclose only the graph elements necessary for the relying party's analysis.

IANA ConsiderationsThis document has no IANA actions.