Add ACB-001 Authorization Consumption Boundary

[safal207]

What changed

Introduces ACB-001 — Authorization Consumption Boundary, a framework-neutral executable contract for binding a concrete authorization occurrence to the concrete execution occurrence that consumes it.

Contract

• separates decision_ref, decision_event_id, and execution_id;
• recomputes a canonical execution-scope digest over logical operation, tool, normalized args, actor, policy, authority and relevant state refs;
• revalidates named freshness conditions;
• models one-shot and explicitly reusable authorization consumption;
• blocks cancelled, superseded, stale, revoked, expired, denied or already-consumed authorization;
• refuses silent first-match resolution when one semantic decision has multiple issued occurrences.

Executable evidence

Adds JSON Schemas, positive/negative fixtures, a reference verifier, and an 18-test conformance suite covering scope mutation, actor/authority drift, freshness drift, retry replay, explicit reuse limits, cancellation, supersession, semantic collisions, exact occurrence resolution and policy-version drift.

Local reference run before publication: 18/18 PASS.

Relationship to ACI-001

ACI and ACB stay separate:

ACI: may this actor act now?
ACB: which exact permission may this exact execution consume now?

A consequential runtime may require both before releasing an effect.

Origin

This operationalizes RESONANCE Article 10, Consent Has a Causal Lifetime, derived from the CrewAI deferred-authorization / stale-consent / occurrence-binding discussion and the AG2 intent-bound preflight contract.

Scope / non-claims

This is a reference/conformance contract. It does not claim CrewAI, AG2, or another vendor has adopted ACB; it does not claim distributed transactional atomicity with arbitrary side effects or formal safety/liveness proof.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d868df3d-f70f-40d1-a928-555d1c5783c9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

Exact-head conformance is green.

head: c989776bc366673a2b7fddf57c653fe3b914db41
workflow: ACB conformance
run: 31865527490
status: completed
conclusion: success

Canonical run:
https://github.com/safal207/pythiaLabs/actions/runs/31865527490

RESONANCE executable-evidence addendum:
https://github.com/safal207/RESONANCE/blob/main/issues/001-age-of-agents/articles/10-consent-has-a-causal-lifetime.acb-001-proof.md

The PR remains draft. This is a reference/conformance contract, not a claim of vendor or production adoption.