Discovery date: 8 October 2026
A privileged action is authorized only when the grant is bound to the requesting principal, task, tool, exact arguments, validity window, and a fresh one-shot nonce.
[ \mathrm{Invoke}\Rightarrow \mathrm{BoundPrincipal}\land \mathrm{BoundTask}\land \mathrm{BoundTool}\land \mathrm{BoundArgs}\land \mathrm{Fresh}\land \mathrm{ActivePrincipal}. ]
On successful invocation the nonce is consumed, so replay is rejected.
A persisted prefix, cached approval, or reusable allow rule is not sufficient authority for a later request when requester, task, arguments, freshness, or principal state differ.
Reference-model validation: 16/16 PASS.
The suite covers valid invocation, replay rejection, cross-task reuse, cross-principal access, inactive principals, tool mismatch, argument/content substitution, expiry, pre-issued use, signature tampering, strict boolean evidence semantics, and the distinction between a valid signature and invocation authority.
The executable is a reference invariant model. Direct upstream regression remains a separate evidence layer.
persist_execpolicy_amendment, documented to persist approved prefixes for future commands.sv.gate/0 authorization/evidence-binding defects and proposed additive repair.