---
title: "Check the requester and scope."
description: "Do not infer authority from a title or UI state; bind actor, session, role, delegation, case, and scope exactly."
updated: "30 August 2026"
availability: "LOCAL SIMULATION · TEST_ONLY"
candidate_route: "/docs/raiffa/guides/bind-identity-scope"
---

# Check the requester and scope.

Do not infer authority from a title or UI state; bind actor, session, role, delegation, case, and scope exactly.

**LOCAL SIMULATION · TEST_ONLY:** Local validation surfaces and fixed fixtures only · no real login, organizational authority, operational API, external execution, or authority issuance

## Identity is a validation chain, not one string

- Authenticated subject and session assertion
- Organization and tenant binding
- Current role and assurance mode
- Delegation issuer, delegate, and allowed scope
- Policy version and validity window
- Revocation revision and lifecycle state

## Never widen scope by interpretation

Requested action, subject, purpose, case, and boundary must match the authorized scope exactly. A senior title or similar subject does not expand the binding.

1. **Verify the request actor** — Match the session subject to the actor named in the request.
2. **Verify delegation** — Check who delegated which scope, until when, and under which separation-of-duty rules.
3. **Verify case binding** — Match current DecisionCaseRef id, digest, and issuer exactly.
4. **Compare scope** — Close the path when operation, boundary, tenant, or case differs.

## Current scope: owner-held TEST_ONLY validation

Policy/Identity packages validate local source and owner-attested plan structure. They do not provide a real IdP login, organization directory, production session persistence, or entitlement writer.

> **Current missing binding:** Sandbox authorization has no exact server actor, session, and DecisionCaseRef eligibility mapping.

---

Published route: /docs/raiffa/guides/bind-identity-scope