The ask tier's escalation path: capability-request (ExaDev/wire-mesh#78) routed up the token's own issuer chain. An agent needing elevation asks its immediate issuer first; the issuer either grants from its own remaining depth or forwards the same request up the chain toward the root, which for user-issued permissions is the user principal.
The chain is cryptographically explicit in every token, so the climb is verifiable rather than trust-based, and gossip-advertised grant candidates (ExaDev/wire-mesh#87) already answer "who nearer than the root can grant". The routing policy itself, walking an issuer chain, is the new work; nothing today does it.
The ask tier's escalation path: capability-request (ExaDev/wire-mesh#78) routed up the token's own issuer chain. An agent needing elevation asks its immediate issuer first; the issuer either grants from its own remaining depth or forwards the same request up the chain toward the root, which for user-issued permissions is the user principal.
The chain is cryptographically explicit in every token, so the climb is verifiable rather than trust-based, and gossip-advertised grant candidates (ExaDev/wire-mesh#87) already answer "who nearer than the root can grant". The routing policy itself, walking an issuer chain, is the new work; nothing today does it.