WEB4-048 · WEB4

Federated Machine Trust and Sovereign Authority

External trust can cross a boundary; local authority cannot be imported automatically.

Big idea

External trust can cross a boundary; local authority cannot be imported automatically.

Picture

See the structure

A visiting student badge checked at the school gate, then mapped to local classroom rules.

PartnerA external identity passes through trust verification, federation agreement, and local mapping while remote ALLOW is blocked at the sovereignty boundary before Askander local authority. — **Trust Is Not Authority.** Figure 1. PartnerA identity and trust facts pass verification, agreement, and mapping checks. A remote ALLOW is stopped at the sovereignty boundary; only Askander policy, JIT, Mission, and runtime state can produce Askander authority.

The simple version

Explain it like I’m ten

A student visits from another school with a real badge. The host school can believe the badge and map the student to a visitor group, but the badge does not let the visitor enter every room. The host teacher still decides local permissions.

Tell it at dinner

A story worth remembering

Now make the same problem larger: replace the children and ordinary objects with people, organizations, AI agents, robots, records, and resources moving at machine speed. Federation verifies and maps external facts under bounded agreements while local identity mappings, policy, JIT, mission, posture, credentials, data authority, and current trust remain sovereign. Institutions can collaborate across trust domains without surrendering local control or accepting transitive, overbroad machine permissions.

Pause at the moment the small system could go wrong. That is the design question the paper keeps in view: not whether people or helpers are clever, but whether the surrounding structure preserves the intended meaning when action scales.

That is why the small story holds: external trust can cross a boundary; local authority cannot be imported automatically.

Explain it to a CEO

Why leaders should care

Institutions can collaborate across trust domains without surrendering local control or accepting transitive, overbroad machine permissions. Federation verifies and maps external facts under bounded agreements while local identity mappings, policy, JIT, mission, posture, credentials, data authority, and current trust remain sovereign.

Explain it to an engineer

What the model means

Use signed external assertions, versioned trust bundles, audience and replay controls, explicit principal/capability/resource/role mappings, pairwise identities, disclosure profiles, local evaluation, agreement lifecycle, and separate federation/delegation provenance.

Talk hook

A valid passport gets you to the border; it does not make you the mayor.

Ask the room

Which external fact should your organization accept without importing the sender's authorization decision?

Go deeper

The Canon is the source of truth.

WEB4-048 formalizes this structure: Federation verifies and maps external facts under bounded agreements while local identity mappings, policy, JIT, mission, posture, credentials, data authority, and current trust remain sovereign. The ordinary-life story is an intuition aid, not a replacement definition; the canonical paper remains authoritative for scope, terminology, limitations, and argument.

Read WEB4-048 — the authoritative paper →