Society · Protocols
BearerToken
Possession-based authorization independent of token representation
Definition
Mechanism
A portable authorization artifact whose presentation is sufficient to exercise a declared grant. The bearer need not prove an Identity or possession of separate key material. A verifier resolves the token's validity and token-conferred authority through an authority-defined mechanism, such as local verification of a protected structured token or lookup or introspection of an opaque reference token. Representation, expiry, revocation, and transfer policy are supplied by descendants or the deployment.
Postconditions
- Verifier produces an authorization decision from token acceptance and associated grant without separate bearer identity proof
Invariants
- Possession Semantics: Presenting the same valid token confers the same token-scoped authority regardless of the bearer's Identity.
- Validation Boundary: Token-conferred authority is recognized only when the verifier's authority-defined validation mechanism accepts the token for the requested use.
Risks
Failure modes
Disclosure
A party that obtains an accepted token can exercise its token-conferred authority.
Relationships
Builds on
References
Infrastructure
Unique agent context (The Who)
Used by
References
Time-decaying privileges
Composes with
Cost-distance indexing
Reference