WEBVTT

1
00:00:00.000 --> 00:00:03.644
Binding the Request, the Effect, and the Resource.

2
00:00:03.644 --> 00:00:08.328
Change the resource and show that the permit does not follow it.

3
00:00:08.328 --> 00:00:13.605
A PERMIT is bound to the actor, the request, the effect, and the resource.

4
00:00:13.605 --> 00:00:17.364
In this run the permit is for lab.observe on scope-a.

5
00:00:17.364 --> 00:00:23.437
Before Rain runs, the resource is changed to scope-b and the same nonce is presented.

6
00:00:23.437 --> 00:00:25.967
The workstation rejects the binding.

7
00:00:25.967 --> 00:00:29.220
Dispatch stays false and executed stays false.

8
00:00:29.220 --> 00:00:36.160
Changing the target is a different request for authority, not a detail the old permit can absorb.

9
00:00:36.160 --> 00:00:39.932
Here is the measured teaching-workstation run.

10
00:00:39.932 --> 00:00:42.446
Handle lab.observe for scope-a.

11
00:00:42.446 --> 00:00:43.619
Outcome PERMIT.

12
00:00:43.619 --> 00:00:45.044
Dispatch is false.

13
00:00:45.044 --> 00:00:46.469
Executed is false.

14
00:00:46.469 --> 00:00:50.240
The reason is fresh permit not yet dispatched.

15
00:00:50.240 --> 00:00:52.839
The teaching nonce is on screen.

16
00:00:52.839 --> 00:00:56.526
Present the same nonce with resource scope-b.

17
00:00:56.526 --> 00:00:57.532
Outcome DENY.

18
00:00:57.532 --> 00:00:58.957
Dispatch is false.

19
00:00:58.957 --> 00:01:00.382
Executed is false.

20
00:01:00.382 --> 00:01:02.896
The reason is binding rejected.