Lineage and authority

Lineage binds a child identity to a parent through signed document evidence. A structurally valid chain is not sufficient to establish current privileged authority.

Current TypeScript authority

SDK 0.7.2 verifies signed JWT delegation chains under current owner or explicitly authorized self-root policy. A direct approved self root has no parent delegations; descendants retain each signed link. See identity verification. No universal human-root requirement is inferred from identifier kinds.

Published Rust 1.1.1 APIs

• oas_sdk::lineage::derive_child constructs a child identity from the parent key/document and derivation inputs.
• verify_chain performs local chain verification.
• verify_privileged_authority evaluates a typed authority request through LineageAuthoritySource.
• oas-lineage provides proof, verification and document-provider primitives.

Use the actual returned types and versioned signatures rather than inventing language-equivalent APIs. Each language and package has an independent public API.

Verify the action

1. Resolve the relevant signed documents using trusted providers.
2. Verify parent/child key and proof bindings and chain consistency.
3. Establish the intended root and authority path under verifier-owned policy.
4. Check required scope, finality/freshness and revocation evidence through the configured authority source.
5. Deny privileged actions when the necessary evidence is missing, stale or unavailable.

Never recompute a child's secret key from a parent public key. Never authorize from a shape-only structural precheck or unverified embedded key. Personhood and organizational legitimacy remain separate assurance claims.

See lineage signatures and result types, lower-level chain verification, and anchor policy.