The five invariants

Five rules hold everywhere in Onbe. Everything else in the design follows from them, and the conformance suite exists to prove the server keeps them.

1. The subject is always the human. An agent appears in the token’s act claim and never in sub. This is delegation, not impersonation, and a tool server that sees no act claim knows a human called it directly.
2. Scope only narrows. At issue, at refresh, and at every delegation hop. Never widens, for any reason.
3. A token never outlives its task. A six-hour job does not hold a six-hour credential.
4. Every authorization decision is recorded, and denials most of all. A denial that was not written down did not happen as far as the person it protects is concerned.
5. No secret is ever logged, returned in an error, or committed.

Note

Each of these is guarded by a test in the conformance suite, run against a live instance through its public surface rather than against the code that implements them.