Lab: watch a delegation chain run away

The delegation lesson listed max_depth among the controls without saying much about what a runaway chain costs. Twenty lines make the failure legible.

1. 1

   Model delegation records and a depth counter carried along the chain.

   bash Copy

   cat > /tmp/depth.py <<'EOF'
   DELEGATIONS = {("a","b"): {"max_depth": 2},
                  ("b","c"): {"max_depth": 2},
                  ("c","d"): {"max_depth": 2}}
   
   def delegate(frm, to, depth):
       d = DELEGATIONS.get((frm, to))
       if not d:
           return f"  {frm}->{to} DENIED (no delegation record)"
       if depth > d["max_depth"]:
           return f"  {frm}->{to} DENIED (depth {depth} over max_depth {d['max_depth']})"
       return f"  {frm}->{to} ok at depth {depth}"
   
   print("a asks b, which asks c, which asks d:")
   for (frm, to), depth in [(("a","b"),1), (("b","c"),2), (("c","d"),3)]:
       print(delegate(frm, to, depth))
   EOF
   python3 /tmp/depth.py

2. 2

   Every hop was individually authorised. The third was refused for how far it was from the original request.

   text Copy

   a asks b, which asks c, which asks d:
     a->b ok at depth 1
     b->c ok at depth 2
     c->d DENIED (depth 3 over max_depth 2)

3. 3

   Clean up.

   bash Copy

   rm /tmp/depth.py

Notice what the limit is not doing. Every delegation in that chain was created by a human and every hop was permitted, so this is not catching an unauthorised call. It is bounding how far an instruction can travel from whoever originally made it.

• Each hop carries the previous agent's context forward, so text that entered at a is being acted on at d, three interpretations later.
• Accountability thins with distance. At depth three the question of who asked for this has three plausible answers and no single owner.
• Without a limit the chain is bounded only by the delegation graph, and a cycle in that graph is unbounded.