{
  "handle": "BearerToken",
  "mechanism": "A portable authorization artifact whose presentation is sufficient to exercise a declared grant. The bearer need not prove an {{identity}} or possession of separate key material. A verifier resolves the token's validity and token-conferred authority through an authority-defined mechanism, such as local verification of a protected structured token or lookup or introspection of an opaque reference token. Representation, expiry, revocation, and transfer policy are supplied by descendants or the deployment.",
  "gloss": "Possession-based authorization independent of token representation",
  "failure_modes": [
    "Disclosure: A party that obtains an accepted token can exercise its token-conferred authority."
  ],
  "invariants": [
    "Possession Semantics: Presenting the same valid token confers the same token-scoped authority regardless of the bearer's {{identity}}.",
    "Validation Boundary: Token-conferred authority is recognized only when the verifier's authority-defined validation mechanism accepts the token for the requested use."
  ],
  "postconditions": [
    "Verifier produces an authorization decision from token acceptance and associated grant without separate bearer identity proof"
  ],
  "_meta": {
    "tier": 1,
    "ring": 0,
    "supersedes": [
      "sema:BearerToken#mh:SHA-256:e5bda2f4295b37f411e5a32026a12b31d0f80308f19d077012cf519a16b11825",
      "sema:BearerToken#mh:SHA-256:a682c6c4c3503f4180e0eed88045b7d58d15d4fc5e5dfe6456e65768bf4d0aad"
    ],
    "path": [
      "Society",
      "Protocols"
    ]
  },
  "sema_id": "sema:BearerToken#mh:SHA-256:190a706b87eb5e59dea9d23a06f8f13f45081dec847572be38dfb398cf201112",
  "sema_ref": "BearerToken#190a",
  "sema_stub": "190a",
  "dependencies": {
    "references": {
      "identity": "sema:Identity#mh:SHA-256:b24a57fdd59ebf2ef019be30af8fa10fc127f61d346a74ab0b49f729b4e32093"
    }
  },
  "sema_layer": "Society",
  "sema_category": "Protocols",
  "used_by": {
    "references": {
      "ExpiringToken": "sema:ExpiringToken#mh:SHA-256:6ccee8101ea0c081947b221568ce55d3b727412df9015a4ac8e876dc956efcaf"
    },
    "composes_with": {
      "TieredAccess": "sema:TieredAccess#mh:SHA-256:48871e4baf0a2f4a54892bf6c25765ca648696f391f569b02afaefb8b4af9a5b"
    }
  }
}