The reason is what makes a refusal auditable — three refusal vocabularies met on the walls this fortnight, and ours came with vectors

2026-11-03 · RTTP · IQA

Reading the Draft · No. 23 · Sources cited in this piece · the text the vectors are anchored to, quoted sentence by sentence: draft-li-rttp-iqa-addressing-02 (full text) · series page and revision history: datatracker · the vector family this piece introduces: iqa.org/conformance/aicent-grant-ref/ (four files, per-file SHA-256) · canonical source: Aicent-Stack/conformance · candidates/aicent-grant-ref · open as candidate: Agent-Authority-Conformance lab, PR #210 · the threads on the record: draft-tanase-ain-authoritative-resolution · draft-hulea-wimse-agent-mandate · our replies on the WIMSE archive: on the identifier-join thread · on the three-questions thread · the W3C wall thread: public-agentprotocol, November 2026 · Sister pillars: RTTP (rttp://, CRI 27) · IQA (iqa://, CRI 28)

On 3 November our conformance archive went public with two vector families, announced on the W3C wall as an independent topic; the family pages live at iqa.org/conformance/aicent-grant-ref/ and /aicent-lease-boundary/, four downloadable files each, every expectation pinned to the published text of draft-li-rttp-iqa-addressing-02. The timing was not an accident of the calendar. The fortnight before, the walls had been doing exactly what this family is built for: arguing about refusal semantics — who owes which reason, when an observation must be null, whether a missing proof and a proof never issued are the same thing. This piece records that argument as it happened, then introduces the family we built so that our own answer to it would not have to win debates — only be run.

Figure 1: the vocabulary the family tests. The priority order is not documentation — it is the definition: emit the first value whose condition applies, and if no condition applies, emit null.

A third vocabulary forming in public

The clearest record is a thread that opened on 27 October under three questions about cross-domain authority evidence, asked by the author of draft-tanase-ain-authoritative-resolution — where competence is established, when validity is judged, and how a decision is verified after the fact. A respondent speaking for a mandate specification answered question by question, anchoring validation results to digests. Then a reviewer pressed the point that matters: a single status_unavailable code, the reviewer said, folds six genuinely different situations into one wire value — a verifier cannot degrade differently on situations it cannot tell apart. The reply conceded, and the follow-up did the structurally right thing: five codes instead of one — unavailable, untrusted, stale, conflict, unrecognized — plus a fixed reading order over subject, anchor, and time, so that the same input yields the same code. The thread's opener closed it on 29 October with the sentence this whole fortnight was about: “Preserving the reason matters for subsequent review and audit.”

That is the third closed refusal vocabulary to take shape in public since this series began covering the space — and all three converged on the same three properties: the set is closed, the reasons are distinguishable, and the reading order is fixed. Nobody in that thread argued for a richer vocabulary. Everybody argued for a legible one. The disagreement was never about whether reasons matter; it was about whether one code can be allowed to stand for six.

Missing is not never-issued

The second thread fought over a sharper edge. A proposal on the table would let a verifier carry a standing commitment instead of an identifier join — verify against a commitment the source publishes, without the source being visible to the verifier. The objection came in two parts, and both were about the refusal the verifier owes: if the commitment is picked by the presenter and the as-of time floats with it, a withdrawal can survive until the commitment's own horizon expires; and worse, toward a caller the verifier did not authenticate, a proof that is missing and a proof that was never issued are not distinguishable — the verifier cannot say which refusal is true without inventing facts. The proposal's author took both objections and drafted the missing-proof clause rather than defending the gap.

Our reply on that thread drew the line we had already published, because §8.1 had already drawn it. An unreachable source — or an observation that predates the request — ends in authority_not_determined, and is never read as assent; a commitment that is present while its proof is missing is a different situation entirely, and is evaluated and denied. The two refusals look alike to the caller and mean opposite things to the audit: one says the verifier could not see, the other says the verifier saw and the answer was no. The section's own sentence is the whole argument in one line: “the reason is what makes a refusal auditable.” And the enforcement is stated, not wished for: “a refusal reason MUST be computed over the authority facts the response carries — facts a third party can re-derive from pinned inputs. A refusal computed over labels, opinions, or unrecorded context alone is not auditable.”

The credential-sharing argument, one more time

The W3C wall supplied the rationale from an unexpected quarter this month. In the Layer 0 thread, Alan Karp objected to a three-part architecture whose third part was runtime enforcement backed by authentication, in one sentence: “Any time you use authentication as part of making an access decision, you encourage credential sharing or proxying.” That is §8.1's own argument arriving independently — an opaque refusal does not add security, it prices the legitimate caller into borrowing someone else's key. A closed vocabulary with a fixed order is not bureaucracy; it is the thing that makes the legitimate path cheaper than the illegitimate one. The walls argued it; the draft prices it; the vectors, as the next section shows, make it testable.

The family that pins it down

aicent-grant-ref is the vector family for everything above. Twenty-five cases — 11 conformant, 12 nonconformant, 2 ambiguous — each one a complete answer-time scenario: the facts on record, one response an implementation could produce, and the rule that decides whether that response satisfies the text. Five reading rules do the deciding. R-ORDER holds that the priority order is part of the definition, including the case where no condition applies at all and the reason must be null — emitting a refusal value without a condition is nonconformant. R-NOTDET holds that an unreachable source, or an observation older than the request, ends in authority_not_determined and is never read as assent — and that a diagnostic read does not participate in authorisation. R-NULLOBS holds that observation_as_of_ms is null whenever the observation the answer relied on is absent or not fresh, even if a later successful observation exists — a diagnostic read neither backfills the member nor renews the evidence. R-CLOSED holds that the set is closed: no affirmative “granted” value, no sixth value, no response without its reason, and null reason over the set as the only representation of permitted. R-GRANTREF holds that every response, permit or refusal, carries the five members of the grant reference.

The two ambiguous cases are scored in named parts rather than forced to a verdict, so a case can show which part of an outcome holds and which does not — an open reading is recorded as an open reading, not flattened into pass or fail. At the submitted revision the checker agreed with all 25 expected results and the mutation battery killed 21 of 21 mutants, each with exit 0; the battery includes versions of every rule that always answer nonconformant and always answer conformant, so a checker that cannot tell a correct implementation from a broken one fails loudly instead of pretending to score. Every expectation is anchored to §8.1 and §8.2 of the published draft — one quoted sentence per rule, the retrieved TXT pinned at sha256 02491c5a — and the honesty section of the CANDIDATE says so in exactly those terms: the runs say nothing about any implementation, and they do not show that the expected results are the right reading of the source. That reading is written out for anyone to dispute.

Figure 2: the receipt the family tests. The race record is structural: when the facts were effective, when they cease to be, and when they were actually observed — with the observation member null exactly when the answer leaned on nothing fresh.

What the vectors do not claim

The family's own documents draw the limits, and the limits are the credibility. The source is one document at one revision — a revised draft needs a new revision of the family. The five members are tested for presence, not for value formats; the relationship between expires_at_ms and the lease rules of §6 belongs to the sibling family, not this one. The checker encodes one reading of the source, and a correction in a later revision of the draft overrides it. What the family claims is narrower and stronger: that the closed vocabulary, its order, the null rule, and the receipt structure are pinned to published sentences, that a third party can run the same cases in minutes with nothing but Python 3, and that a checker which quietly stopped checking one of the five rules will be caught by the battery that ships alongside. The walls spent a fortnight establishing that reasons must be distinguishable. The family is how ours stops being a claim and becomes a test.

One line: three refusal vocabularies converged in public this fortnight on the same three properties — closed set, distinguishable reasons, fixed order — and aicent-grant-ref pins our vocabulary to the published text with twenty-five cases and a mutation battery, so that “the reason is what makes a refusal auditable” is something you can run, not something you have to believe.