[ PROOFECONOMY ]™GlossaryOriginSpecsCapability Token
A capability token is a short-lived, signed credential that grants an agent exactly the actions it names, bound to one task, revocable at once, and attenuating only: a holder can narrow it, never widen it. It replaces ambient authority, the power an agent inherits without being granted it.
What it means
An agent that inherits its parent’s API key, shell or cloud role has ambient authority: power nobody granted for this task, that nobody can take back cleanly. You cannot revoke what you did not issue.
A capability token is the opposite. The supervisor mints one per worker per task. The enforcer accepts nothing else. Its properties:
- Attenuating only. A derived token’s permissions are a strict subset of its parent’s. Asking for more scope is a request to a human, never a self-service operation.
- Task-bound. The task identifier is in the token, so a worker cannot replay a sibling’s authority.
- Short-lived and revocable. Freeze means revoke, and it takes effect on the next check. A long-lived capability is not a capability; it is a credential.
- No transitive grant. A worker cannot pass its token to a sub-worker. Only the supervisor mints.
In Proof Protocol
The Declared Policy names an agent’s allowed credentials and delegation targets, and a Warden judges conduct against them. In a Hard Cell the agent’s credentials are revoked before it is suspended; in a Sting Cell they are swapped for per-arrest decoy credentials. Escape vector ES-07, hand-off to another agent, is the test of whether authority can be passed where it should not go. See Sting Cell and Hard Cell.
Related terms
- Agent Boundary
- Confused Deputy
- Declared Policy
- Escape Test Suite (ES-01 to ES-09)
- Sting Cell and Hard Cell