GoodShyt Group Inc.

San FranciscoCAUS deonte@goodshyt.fun https://orcid.org/0009-0005-8586-3650

Security Web Authorization Protocol authorization evidence fail closed state transitions invariants distributed systems Distributed authorization systems frequently combine observations, policy evaluations, evidence records, authorization decisions, and execution receipts. Treating these different objects as interchangeable can create fail-open behavior, stale-authority bugs, and false claims of completion.This document defines non-collapse semantics: explicit typed transitions between observation, evidence, authorization, and execution state; fail-closed treatment of missing or indeterminate premises; and comparison rules for determining when heterogeneous representations agree on a declared invariant. The document is informational and defines no new wire protocol.

IntroductionSecurity protocols often cross several semantic layers. A sensor or log records an observation; software interprets that observation; a verifier may accept evidence; an authority component may issue permission; and a separate component executes an action. Operational failures occur when one layer is silently substituted for another.

This document defines a compact model for keeping these layers distinct while still allowing explicit promotion between them.

Requirements LanguageThe key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals.

Typed State Model

Observation Record:

A measurement, log entry, status report, or externally visible event.

Interpretation Record:

A classification or conclusion derived from one or more observations.

Evidence Record:

An interpretation or observation accepted under a declared validation procedure for a defined purpose.

Authorization Decision:

A decision that a principal or workload may perform a scoped action under stated conditions.

Execution Receipt:

A record that an action was attempted, executed, or became externally effective.

These types are not interchangeable. A deployment MAY encode them using the same serialization syntax, but it MUST preserve their semantic roles and transition rules.

Explicit PromotionA state at layer L_i does not automatically imply a state at L_i+1. Promotion requires an explicit rule P_i with declared inputs, validation criteria, authority, and resulting state.

Evidence --P1--> Authorization --P2--> Execution ]]>

If a required premise is false, the transition MUST fail. If no required premise is false but at least one required premise is unknown, unavailable, stale, or indeterminate, the transition MUST NOT be treated as successful.

Selection SemanticsA system selecting among authorized actions MUST distinguish an empty authorized set from a successful selection. If the authorized set is empty, the result is INFEASIBLE and no action is selected. If multiple actions are equally preferred and no deterministic or authorized tie-breaking rule exists, the result is TIE_REQUIRES_SELECTION_RULE and no action is selected."Do nothing" is not implicit authorization. A deployment that permits a no-op or defer action SHOULD model it explicitly.

Invariant Agreement Across RepresentationsTwo records expressed in different units, coordinate systems, or protocol views can agree only after a declared bridge maps them into a common comparison space. Raw coordinate equality is not required; lawful correspondence is. An empty required comparison set, a missing required representation, unaligned snapshots, or invalid uncertainty coverage is INDETERMINATE. A unit or comparison-space mismatch that violates the declared bridge is FAIL. Neither condition is PASS.

Relation Types

• STRICT_INVARIANT: the compared value is unchanged under the declared transformation.
• COVARIANT: the value changes according to a declared transformation law.
• QUOTIENT_EQUIVALENT: different representatives map to the same declared equivalence class.
• TOLERANCE_EQUIVALENT: values agree only within a declared metric and tolerance.

Authorization Examples

• A successful OAuth revocation request is an observation about request handling, not proof that all derived authority is closed.
• A valid signature proves integrity/authenticity properties of the signed object; it does not by itself prove freshness, authorization, or policy compliance.
• An authorization decision does not prove that the requested side effect actually executed.
• An execution receipt does not retroactively authorize an action that lacked valid authority.

Relationship to Existing IETF Work defines authorization evidence for OAuth access tokens. propagates identity and authorization context through call chains. distinguishes agent identity, credentials, authentication, authorization, and observability. The non-collapse model in this document is complementary: it focuses on the semantics of transitions among such states. is a concrete application of this principle: REQUESTED, invalidated, enforced, and CLOSED are distinct states.

Security ConsiderationsCollapsing state types can create authorization bypasses and false assurances. A system that treats observation as authorization may allow untrusted telemetry to grant privilege. A system that treats request acknowledgement as execution evidence may claim work completed when it did not. A system that treats unknown required premises as true may fail open. Implementations SHOULD therefore retain typed state, provenance, freshness, and transition authority sufficient to reconstruct why a promotion occurred.

Privacy ConsiderationsEvidence and execution records can reveal sensitive identities, user actions, delegation relationships, and operational topology. Implementations SHOULD minimize retained fields and SHOULD avoid turning cross-system evidence identifiers into unnecessary global correlation identifiers.

IANA ConsiderationsThis document has no IANA actions.

ReferencesNormative ReferencesInformative References