SEDI Ward Authorization (sedi-ward-authz)¶

Bakobo provisional Tier C profile, version 1.0.0. The guardian issues this registry-bound credential to the ward, using the guardian's own registry so authorization can be revoked separately from state-issued guardianship. The authority edge requires I2I to the guardian's guardianship credential, Sam Smith's at keripy 927c0cb8, and the subject edge requires E1E to the ward's Core credential, the one whose guardians group reaches the guardianship. Both far-schema SAIDs are pinned; the revision pinned to the 80f77b73 schemas and Bakobo's guardian 3.0.0 stays resolvable in sedi-ward-authz-pre-927c0cb8-1.0.0/ (this.i @6uxg0vj0). The a.authz.rc list grants capabilities for named resource routes; a route is a value, so paths containing / can be serialized without using illegal CESR field labels.

Sam Smith's #1550 discussion leaves authorization syntax open. This route-and-capability list is a Bakobo demo choice informed by Daniel Hardman's ward authorization example. It is not a Utah statutory vocabulary. Sam's guardianship carries a role and no delegable powers or scope, so a verifier must reject any capability that a role-to-capability policy it holds does not authorize for the guardian's role; a verifier with no such policy must reject every grant. It must also ensure all edges resolve to the named parties, the guardianship's ward is the subject Core's issuee, and both registries show live status. The example's r still names the guardian 3.0.0 governance, whose scope-enforcement clause refers to fields Sam's guardianship lacks, so under those rules a verifier must reject; a governance revision for Sam's guardianship is open (~2j4d). JSON Schema cannot enforce those cross-credential checks.

example.json is issued by Gal to Wyn: its authority edge reaches Gal's guardianship (sedi-guardian/example.json) and its subject edge reaches Wyn's Core (sedi-core/examples/wyn-ward.json), both Sam's vectors. invalid/ contains absent registry, bad operators, an empty capability list, and a missing ward issuee. The separate status of this authorization and the guardianship supports independent revocation.