Delegation
Scope attenuation, proof verification, storage, and revocation propagation.
The aegis-delegate crate separates proofs, scope rules, session keys, delegation storage, trees, and revocation stores. A delegation may only grant authority supported by its verified parent chain and policy.
Delegate an action
Verify the parent authority first, restrict the child scope/depth/lifetime, sign the intended delegation proof, and persist it through the configured store. The consuming service must verify the proof and applicable revocation state before authorizing an operation.
Revoke deliberately
RevocationRegistry exposes revoke, is_revoked, and revoke_cascade. The cascade method accepts IDs to revoke; a local in-memory registry does not make remote caches or separate services immediately consistent. Tree traversal, persistence, propagation and cache invalidation must be configured and exercised by the application.
Use DelegationStore and RevocationStore implementations appropriate to your deployment. In-memory stores are process-local. Test broadened scope, depth exhaustion, expired proof, missing ancestor, and revoked parent behavior.
See delegation module signatures and server authority verification.