How an authority-graph edge came to be — the attenuate-vs-mint distinction.
Typing every issuance edge lets the record tell offline narrowing apart from a
trusted-issuer crossing; the two carry different safety properties (only the
former is safe to delegate offline). Only Attenuate is used;
Mint is reserved and inert, retained so the enum stays stable.
Narrowing WITHIN a subject namespace (a decern tenant): child scopes ⊆ delegator,
same tenant. Offline-delegable — an intermediate delegate produces it with no
issuer. The default and overwhelmingly common edge.
CROSSING a subject namespace: a fresh trusted-issuer binding (an external
token verified against its JWKS, or a redeemed cross-app assertion). NEVER
offline-delegable — “you cannot narrow your way into a subject you were never
given.” Reserved and inert: no shipped path emits it.