# AVC — schema and validation

## Schema

An AVC carries a unique id, subject and issuer actor ids, an optional parent AVC id (for delegation), a policy domain, a scope (action set + optional constraints), validity window, and an issuer signature.

## Delegation

Delegation strictly narrows scope: a child AVC's permitted actions and constraints must be a subset of its parent's. Validation rejects any attempt to widen scope beyond the parent.

## Validation rules

- Signature verifies under the registered issuer key.
- Current time is within `not_before`/`not_after`.
- Subject actor is `active`.
- Issuer actor is `active` and authorized to issue in the policy domain.
- Parent AVC, if present, is itself valid and not revoked.
- Scope is contained within the parent's scope.
- Policy expressions evaluate without error.

Validation is fail-closed and deterministic.

## Revocation

An issuer revokes their AVC by submitting a signed revocation. The revocation cascades to all derivative AVCs. Already-issued trust receipts under the revoked AVC remain as evidence of past authorization.

## Signature algorithms

ML-DSA-65 (CRYSTALS-Dilithium) is the post-quantum signature for new AVCs. Hybrid signatures are supported for transitional environments.