permissiondiff 0.1.1__tar.gz → 0.2.0__tar.gz

{permissiondiff-0.1.1 → permissiondiff-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: permissiondiff
-Version: 0.1.1
+Version: 0.2.0
 Summary: Deterministic differential authorization regression testing
 Keywords: authorization,ci,differential-testing,property-based-testing,security-testing
 Author: Abishek Giri
@@ -163,6 +163,28 @@ invariants:
 
 The callable receives `(AuthorizationCase, Decision)` and returns `bool` or `InvariantResult`.
 
+## Least-privilege review
+
+`mine` reports the authorizer's effective grant surface — each distinct role × action ×
+resource-type × tenant-relation × ownership pattern it allows — and flags **broad** grants (those
+crossing a tenant boundary or reaching a non-owned resource) for tightening:
+
+```bash
+uv run permissiondiff mine --config permissiondiff.yaml
+```
+
+## Policy engines and agents
+
+Wrap an external policy engine as the authorizer with the adapter toolkit in
+`permissiondiff.adapters` (`from_boolean`, `from_decision`, or `http_authorizer` for OPA-style
+endpoints); runnable example adapters for OPA, OpenFGA, Auth0 FGA, Cedar, and SpiceDB live under
+[`examples/adapters/`](https://github.com/abishekgiri/permissiondiff/tree/main/examples/adapters).
+Adapters make read-only decision calls — point them at a non-production policy instance.
+
+For agent / on-behalf-of principals, declare `delegated_by: [id, ...]` on a subject. PermissionDiff
+enforces the least-privilege intersection rule: a delegated principal allowed where any delegator
+is denied (on the identical case) is a critical privilege-escalation finding.
+
 ## Baseline and diff workflow
 
 Create a baseline on trusted code:
@@ -179,6 +201,13 @@ uv run permissiondiff diff --config permissiondiff.yaml \
   --baseline .permissiondiff/main.json
 ```
 
+Or skip the snapshot file entirely and diff against a git ref — PermissionDiff evaluates the
+baseline authorizer as it existed at that ref in a temporary, auto-removed worktree:
+
+```bash
+uv run permissiondiff diff --config permissiondiff.yaml --git-ref main
+```
+
 Classification is exhaustive:
 
 | Baseline | Candidate | Result |
@@ -219,7 +248,7 @@ The repository's thin composite action invokes the same CLI without duplicating
 ```
 
 Check out the calling repository before this step and make sure the baseline is present in CI.
-Use `@v0.1.1` to pin the latest release; `@v0` follows compatible v0 releases. The
+Use `@v0.2.0` to pin the latest release; `@v0` follows compatible v0 releases. The
 [published-consumer smoke test](https://github.com/abishekgiri/permissiondiff/blob/main/.github/workflows/published-smoke.yml)
 exercises the PyPI package and the remote action in a fresh workspace without a source checkout.
 

{permissiondiff-0.1.1 → permissiondiff-0.2.0}/README.md

@@ -131,6 +131,28 @@ invariants:
 
 The callable receives `(AuthorizationCase, Decision)` and returns `bool` or `InvariantResult`.
 
+## Least-privilege review
+
+`mine` reports the authorizer's effective grant surface — each distinct role × action ×
+resource-type × tenant-relation × ownership pattern it allows — and flags **broad** grants (those
+crossing a tenant boundary or reaching a non-owned resource) for tightening:
+
+```bash
+uv run permissiondiff mine --config permissiondiff.yaml
+```
+
+## Policy engines and agents
+
+Wrap an external policy engine as the authorizer with the adapter toolkit in
+`permissiondiff.adapters` (`from_boolean`, `from_decision`, or `http_authorizer` for OPA-style
+endpoints); runnable example adapters for OPA, OpenFGA, Auth0 FGA, Cedar, and SpiceDB live under
+[`examples/adapters/`](https://github.com/abishekgiri/permissiondiff/tree/main/examples/adapters).
+Adapters make read-only decision calls — point them at a non-production policy instance.
+
+For agent / on-behalf-of principals, declare `delegated_by: [id, ...]` on a subject. PermissionDiff
+enforces the least-privilege intersection rule: a delegated principal allowed where any delegator
+is denied (on the identical case) is a critical privilege-escalation finding.
+
 ## Baseline and diff workflow
 
 Create a baseline on trusted code:
@@ -147,6 +169,13 @@ uv run permissiondiff diff --config permissiondiff.yaml \
   --baseline .permissiondiff/main.json
 ```
 
+Or skip the snapshot file entirely and diff against a git ref — PermissionDiff evaluates the
+baseline authorizer as it existed at that ref in a temporary, auto-removed worktree:
+
+```bash
+uv run permissiondiff diff --config permissiondiff.yaml --git-ref main
+```
+
 Classification is exhaustive:
 
 | Baseline | Candidate | Result |
@@ -187,7 +216,7 @@ The repository's thin composite action invokes the same CLI without duplicating
 ```
 
 Check out the calling repository before this step and make sure the baseline is present in CI.
-Use `@v0.1.1` to pin the latest release; `@v0` follows compatible v0 releases. The
+Use `@v0.2.0` to pin the latest release; `@v0` follows compatible v0 releases. The
 [published-consumer smoke test](https://github.com/abishekgiri/permissiondiff/blob/main/.github/workflows/published-smoke.yml)
 exercises the PyPI package and the remote action in a fresh workspace without a source checkout.
 

{permissiondiff-0.1.1 → permissiondiff-0.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "permissiondiff"
-version = "0.1.1"
+version = "0.2.0"
 description = "Deterministic differential authorization regression testing"
 readme = "README.md"
 requires-python = ">=3.12"

{permissiondiff-0.1.1 → permissiondiff-0.2.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "permissiondiff"
-version = "0.1.1"
+version = "0.2.0"
 description = "Deterministic differential authorization regression testing"
 readme = "README.md"
 requires-python = ">=3.12"

{permissiondiff-0.1.1 → permissiondiff-0.2.0}/src/permissiondiff/__init__.py

@@ -20,4 +20,4 @@ __all__ = [
     "Subject",
 ]
 
-__version__ = "0.1.1"
+__version__ = "0.2.0"

permissiondiff-0.2.0/src/permissiondiff/adapters/__init__.py

@@ -0,0 +1,68 @@
+"""User-side toolkit for building a PermissionDiff authorizer from an external policy system.
+
+Adapters live **outside** the core engine (the core never imports this package). An adapter turns
+an external authorization decision -- a boolean check from a policy-engine SDK (OpenFGA, SpiceDB,
+Cedar, Auth0 FGA, ...) or a JSON response from an HTTP policy endpoint (OPA, ...) -- into the
+``authorize(subject, action, resource, context) -> Decision`` callable that PermissionDiff
+evaluates.
+
+Adapters make **read-only decision calls only**. As with any authorizer, point them at a
+non-production / test policy instance -- never at production data or anything with side effects.
+
+Most SDK-based engines reduce to a boolean check, so :func:`from_boolean` is usually all you need;
+:func:`from_decision` covers engines that already return an allow/deny verdict object. See
+``examples/adapters/`` for concrete per-engine wrappers.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+
+from permissiondiff.adapters.http import http_authorizer
+from permissiondiff.models import (
+    Action,
+    AuthorizationFunction,
+    Context,
+    Decision,
+    Resource,
+    Subject,
+)
+
+BooleanCheck = Callable[[Subject, Action, Resource, Context], bool]
+
+__all__ = ["BooleanCheck", "from_boolean", "from_decision", "http_authorizer"]
+
+
+def from_boolean(check: BooleanCheck) -> AuthorizationFunction:
+    """Wrap a boolean allow/deny check (the shape of most SDK calls) as an authorizer."""
+
+    def _authorize(
+        subject: Subject, action: Action, resource: Resource, context: Context
+    ) -> Decision:
+        return Decision.ALLOW if check(subject, action, resource, context) else Decision.DENY
+
+    return _authorize
+
+
+def from_decision(
+    check: Callable[[Subject, Action, Resource, Context], bool | Decision],
+) -> AuthorizationFunction:
+    """Wrap a check that returns a bool or an actual ``Decision``.
+
+    Anything that is not a ``Decision`` or a ``bool`` raises ``TypeError`` so a misconfigured
+    adapter surfaces as an explicit evaluation error rather than a silent wrong verdict.
+    """
+
+    def _authorize(
+        subject: Subject, action: Action, resource: Resource, context: Context
+    ) -> Decision:
+        result = check(subject, action, resource, context)
+        if isinstance(result, Decision):
+            return result
+        if isinstance(result, bool):
+            return Decision.ALLOW if result else Decision.DENY
+        raise TypeError(
+            f"adapter check returned {type(result).__name__}, expected bool or Decision"
+        )
+
+    return _authorize

permissiondiff-0.2.0/src/permissiondiff/adapters/http.py

@@ -0,0 +1,57 @@
+"""Generic HTTP-JSON policy adapter (e.g. Open Policy Agent's data API), standard library only.
+
+This is user-side glue that the core engine never imports. It POSTs a JSON request built from the
+case to a policy endpoint and turns the JSON response into a ``Decision``. Point it at a
+non-production policy server; it performs a read-only decision query.
+"""
+
+from __future__ import annotations
+
+import json
+import urllib.request
+from collections.abc import Callable
+from typing import Any
+
+from permissiondiff.models import (
+    Action,
+    AuthorizationFunction,
+    Context,
+    Decision,
+    Resource,
+    Subject,
+)
+
+RequestBuilder = Callable[[Subject, Action, Resource, Context], dict[str, Any]]
+AllowedParser = Callable[[Any], bool]
+
+
+def http_authorizer(
+    endpoint: str,
+    *,
+    build_request: RequestBuilder,
+    parse_allowed: AllowedParser,
+    timeout: float = 5.0,
+) -> AuthorizationFunction:
+    """Build an authorizer that queries an HTTP-JSON policy endpoint.
+
+    ``build_request`` maps a case to the JSON body to POST; ``parse_allowed`` maps the decoded
+    JSON response to a boolean allow/deny. Network or parse failures propagate, so PermissionDiff
+    records them as explicit evaluation errors rather than guessing a verdict.
+    """
+
+    def _authorize(
+        subject: Subject, action: Action, resource: Resource, context: Context
+    ) -> Decision:
+        body = json.dumps(build_request(subject, action, resource, context)).encode("utf-8")
+        # The endpoint is operator-supplied configuration, not attacker-controlled case data.
+        request = urllib.request.Request(
+            endpoint,
+            data=body,
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            payload = json.loads(response.read().decode("utf-8"))
+        return Decision.ALLOW if parse_allowed(payload) else Decision.DENY
+
+    return _authorize

{permissiondiff-0.1.1 → permissiondiff-0.2.0}/src/permissiondiff/application.py

@@ -10,12 +10,20 @@ from permissiondiff.config import PermissionDiffConfig
 from permissiondiff.engine import (
     compare_decisions,
     comparison_findings,
+    delegation_findings,
     invariant_findings,
+    mine_grants,
 )
 from permissiondiff.evaluator import evaluate_cases
 from permissiondiff.generator import generate_cases
 from permissiondiff.invariants import build_invariants
-from permissiondiff.models import AuthorizationCase, CaseEvaluation, ComparisonResult, Finding
+from permissiondiff.models import (
+    AuthorizationCase,
+    CaseEvaluation,
+    ComparisonResult,
+    Finding,
+    Grant,
+)
 from permissiondiff.snapshot import Snapshot, load_snapshot, snapshot_from_evaluations
 
 
@@ -27,6 +35,15 @@ class RunResult:
     findings: tuple[Finding, ...]
 
 
+@dataclass(frozen=True, slots=True)
+class MineResult:
+    """Effective grant surface plus any cases that could not be evaluated."""
+
+    cases_evaluated: int
+    grants: tuple[Grant, ...]
+    errors: tuple[CaseEvaluation, ...]
+
+
 def run_test(
     config: PermissionDiffConfig,
     *,
@@ -38,10 +55,28 @@ def run_test(
     cases = generate_cases(config, seed=seed, max_examples=max_examples)
     evaluations = _evaluate(config, cases, workdir)
     invariants = build_invariants(config.invariants, workdir=workdir)
-    findings = invariant_findings(evaluations, invariants)
+    findings = [
+        *invariant_findings(evaluations, invariants),
+        *delegation_findings(evaluations),
+    ]
     return RunResult(len(cases), tuple(findings))
 
 
+def run_mine(
+    config: PermissionDiffConfig,
+    *,
+    workdir: Path,
+    seed: int,
+    max_examples: int | None = None,
+) -> MineResult:
+    """Generate cases, evaluate the authorizer, and mine its effective grant surface."""
+    cases = generate_cases(config, seed=seed, max_examples=max_examples)
+    evaluations = _evaluate(config, cases, workdir)
+    grants = mine_grants(evaluations)
+    errors = tuple(evaluation for evaluation in evaluations if evaluation.error is not None)
+    return MineResult(len(cases), tuple(grants), errors)
+
+
 def create_snapshot(
     config: PermissionDiffConfig,
     *,
@@ -60,9 +95,42 @@ def run_diff(
     *,
     workdir: Path,
     baseline_path: Path,
+) -> RunResult:
+    """Replay every exact baseline case (from a snapshot file) against the candidate."""
+    return _diff_against_snapshot(config, workdir=workdir, snapshot=load_snapshot(baseline_path))
+
+
+def run_git_diff(
+    config: PermissionDiffConfig,
+    *,
+    workdir: Path,
+    ref: str,
+    seed: int,
+    max_examples: int | None = None,
+) -> RunResult:
+    """Diff the candidate against the baseline authorizer as it existed at a git ref.
+
+    The ref is checked out into a temporary detached worktree; the candidate config's domain
+    generates the corpus, which is evaluated against the baseline authorizer code there. The
+    candidate then replays that exact corpus in the working tree.
+    """
+    from permissiondiff.gitref import baseline_worktree, repo_root
+
+    relative = workdir.resolve().relative_to(repo_root(workdir))
+    with baseline_worktree(workdir, ref) as tree:
+        baseline = create_snapshot(
+            config, workdir=tree / relative, seed=seed, max_examples=max_examples
+        )
+    return _diff_against_snapshot(config, workdir=workdir, snapshot=baseline)
+
+
+def _diff_against_snapshot(
+    config: PermissionDiffConfig,
+    *,
+    workdir: Path,
+    snapshot: Snapshot,
 ) -> RunResult:
     """Replay every exact baseline case against the candidate authorizer."""
-    snapshot = load_snapshot(baseline_path)
     cases = [snapshot_case.case for snapshot_case in snapshot.cases]
     evaluations = _evaluate(config, cases, workdir)
     comparisons: list[ComparisonResult] = []
@@ -82,6 +150,7 @@ def run_diff(
     findings = [
         *comparison_findings(comparisons),
         *invariant_findings(evaluations, invariants),
+        *delegation_findings(evaluations),
     ]
     return RunResult(len(cases), tuple(findings))
 
@@ -96,4 +165,5 @@ def _evaluate(
         config.authorizer,
         workdir=workdir,
         timeout_seconds=config.execution.timeout_seconds,
+        mode=config.execution.worker,
     )

{permissiondiff-0.1.1 → permissiondiff-0.2.0}/src/permissiondiff/cli.py

@@ -9,14 +9,22 @@ import typer
 from rich.console import Console
 
 from permissiondiff import __version__
-from permissiondiff.application import create_snapshot, run_diff, run_test
+from permissiondiff.application import (
+    create_snapshot,
+    run_diff,
+    run_git_diff,
+    run_mine,
+    run_test,
+)
 from permissiondiff.config import PermissionDiffConfig, load_config
-from permissiondiff.errors import PermissionDiffError
+from permissiondiff.errors import ConfigurationError, EvaluationError, PermissionDiffError
 from permissiondiff.models import Finding
 from permissiondiff.report import (
     assign_finding_ids,
     explain_finding,
     persist_findings,
+    persist_grants,
+    render_grants,
     render_terminal,
     result_exit_code,
 )
@@ -107,6 +115,41 @@ def test_command(
         _unexpected(exc, debug)
 
 
+@app.command()
+def mine(
+    config: CONFIG_OPTION = Path("permissiondiff.yaml"),
+    seed: SEED_OPTION = 42,
+    max_examples: Annotated[
+        int | None, typer.Option("--max-examples", min=1, help="Override corpus size.")
+    ] = None,
+    json_output: Annotated[
+        Path, typer.Option("--json-output", help="Machine-readable grant report path.")
+    ] = Path(".permissiondiff/grants.json"),
+    debug: DEBUG_OPTION = False,
+) -> None:
+    """Report the authorizer's effective grant surface for least-privilege review."""
+    try:
+        loaded = load_config(config)
+        result = run_mine(
+            loaded, workdir=config.resolve().parent, seed=seed, max_examples=max_examples
+        )
+        if result.errors:
+            # Never present a partial grant surface as complete.
+            raise EvaluationError(
+                f"{len(result.errors)} case(s) failed evaluation; "
+                f"first error: {result.errors[0].error}"
+            )
+        grants = list(result.grants)
+        persist_grants(grants, report_path=json_output, cases_evaluated=result.cases_evaluated)
+        render_grants(grants, cases_evaluated=result.cases_evaluated)
+    except typer.Exit:
+        raise
+    except PermissionDiffError as exc:
+        _fail(exc, debug)
+    except Exception as exc:
+        _unexpected(exc, debug)
+
+
 @app.command()
 def snapshot(
     output: Annotated[Path, typer.Option("--output", "-o", help="Baseline JSON path.")],
@@ -138,8 +181,18 @@ def snapshot(
 
 @app.command()
 def diff(
-    baseline: Annotated[Path, typer.Option("--baseline", help="Baseline snapshot path.")],
+    baseline: Annotated[
+        Path | None, typer.Option("--baseline", help="Baseline snapshot path.")
+    ] = None,
+    git_ref: Annotated[
+        str | None,
+        typer.Option("--git-ref", help="Baseline git ref to evaluate in a temporary worktree."),
+    ] = None,
     config: CONFIG_OPTION = Path("permissiondiff.yaml"),
+    seed: SEED_OPTION = 42,
+    max_examples: Annotated[
+        int | None, typer.Option("--max-examples", min=1, help="Override corpus size (--git-ref).")
+    ] = None,
     json_output: Annotated[
         Path, typer.Option("--json-output", help="Machine-readable report path.")
     ] = Path(".permissiondiff/report.json"),
@@ -148,10 +201,23 @@ def diff(
     ] = Path(".permissiondiff/failures"),
     debug: DEBUG_OPTION = False,
 ) -> None:
-    """Replay the exact baseline corpus against the candidate authorizer."""
+    """Replay the exact baseline corpus against the candidate authorizer.
+
+    Provide exactly one baseline source: --baseline (a snapshot file) or --git-ref (a git ref
+    whose authorizer is evaluated in a temporary worktree).
+    """
     try:
+        if (baseline is None) == (git_ref is None):
+            raise ConfigurationError("provide exactly one of --baseline or --git-ref")
         loaded = load_config(config)
-        result = run_diff(loaded, workdir=config.resolve().parent, baseline_path=baseline)
+        workdir = config.resolve().parent
+        if git_ref is not None:
+            result = run_git_diff(
+                loaded, workdir=workdir, ref=git_ref, seed=seed, max_examples=max_examples
+            )
+        else:
+            assert baseline is not None
+            result = run_diff(loaded, workdir=workdir, baseline_path=baseline)
         _finish_run(loaded, result.cases_evaluated, result.findings, failures_dir, json_output)
     except typer.Exit:
         raise

{permissiondiff-0.1.1 → permissiondiff-0.2.0}/src/permissiondiff/config.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 from pathlib import Path
-from typing import Any
+from typing import Any, Literal
 
 import yaml
 from pydantic import BaseModel, ConfigDict, Field, ValidationError, model_validator
@@ -21,6 +21,7 @@ class SubjectConfig(BaseModel):
     tenant: str | None = None
     role: str | None = None
     attributes: dict[str, Any] = Field(default_factory=dict)
+    delegated_by: list[str] = Field(default_factory=list)
 
     def to_domain(self) -> Subject:
         """Convert boundary validation data into the core model."""
@@ -29,6 +30,7 @@ class SubjectConfig(BaseModel):
             tenant=self.tenant,
             role=self.role,
             attributes=self.attributes,
+            delegated_by=tuple(self.delegated_by),
         )
 
 
@@ -104,6 +106,15 @@ class ExecutionConfig(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
     timeout_seconds: float = Field(default=2.0, gt=0, le=300)
+    worker: Literal["persistent", "process_per_case"] = "persistent"
+    """How cases reach the authorizer.
+
+    ``persistent`` (default) imports the authorizer once in a long-lived worker and streams cases
+    over a line-delimited protocol, re-spawning on any crash or timeout so a bad case cannot
+    corrupt later cases -- far faster on large corpora. ``process_per_case`` spawns a fresh
+    interpreter per case (maximum isolation, no shared import state); use it if an authorizer
+    relies on process-global state and cannot tolerate a shared import.
+    """
 
 
 class FailOnConfig(BaseModel):

{permissiondiff-0.1.1 → permissiondiff-0.2.0}/src/permissiondiff/engine.py

@@ -15,10 +15,67 @@ from permissiondiff.models import (
     Decision,
     Finding,
     FindingKind,
+    Grant,
     Severity,
 )
 
 
+def _tenant_relation(case: AuthorizationCase) -> str:
+    if case.subject.tenant is None or case.resource.tenant is None:
+        return "unknown"
+    return "same" if case.subject.tenant == case.resource.tenant else "different"
+
+
+def _ownership(case: AuthorizationCase) -> str:
+    if case.resource.owner_id is None:
+        return "unknown"
+    return "owner" if case.subject.id == case.resource.owner_id else "non_owner"
+
+
+def mine_grants(evaluations: Iterable[CaseEvaluation]) -> list[Grant]:
+    """Aggregate ALLOW decisions into the authorizer's effective, deduplicated grant surface.
+
+    Pure and deterministic. Each distinct (role, action, resource type, tenant relation, ownership)
+    pattern that the authorizer permits becomes one :class:`Grant`, keeping the smallest observed
+    case as its example and counting how many cases matched. Evaluation errors are ignored here;
+    callers surface those separately (mining describes what is allowed, it is not a gate).
+    """
+    groups: dict[tuple[str, str, str, str, str], list[CaseEvaluation]] = {}
+    for evaluation in evaluations:
+        if evaluation.decision is not Decision.ALLOW:
+            continue
+        case = evaluation.case
+        key = (
+            case.subject.role or "",
+            case.action.name,
+            case.resource.type,
+            _tenant_relation(case),
+            _ownership(case),
+        )
+        groups.setdefault(key, []).append(evaluation)
+
+    grants: list[Grant] = []
+    for members in groups.values():
+        example = min(members, key=lambda e: _case_complexity(e.case)).case
+        grants.append(
+            Grant(
+                role=example.subject.role,
+                action=example.action.name,
+                resource_type=example.resource.type,
+                tenant_relation=_tenant_relation(example),
+                ownership=_ownership(example),
+                count=len(members),
+                example=example,
+            )
+        )
+    return sorted(grants, key=lambda grant: grant.key)
+
+
+def _case_complexity(case: AuthorizationCase) -> tuple[int, str]:
+    serialized = json.dumps(case.to_dict(), sort_keys=True, separators=(",", ":"))
+    return (len(serialized), serialized)
+
+
 def classify_change(baseline: Decision, candidate: Decision) -> ChangeType:
     """Classify one exhaustive pair of authorization decisions."""
     mapping = {
@@ -79,6 +136,58 @@ def invariant_findings(
     return minimize_findings(findings)
 
 
+def _delegation_correlation(case: AuthorizationCase) -> str:
+    """Identity of a case ignoring the subject, so delegated and delegator cases correlate."""
+    return json.dumps(
+        {
+            "action": case.action.name,
+            "resource": case.resource.to_dict(),
+            "context": case.context.to_dict(),
+        },
+        sort_keys=True,
+        separators=(",", ":"),
+    )
+
+
+def delegation_findings(evaluations: Iterable[CaseEvaluation]) -> list[Finding]:
+    """Flag delegated principals that obtain more authority than a principal they act for.
+
+    Enforces the least-privilege intersection rule: if a subject that acts on behalf of others is
+    ALLOWED for a case, every delegator evaluated on the identical (action, resource, context) must
+    also be ALLOWED. A delegator DENY under a delegated ALLOW is a privilege-escalation finding.
+    Pure and deterministic.
+    """
+    decisions: dict[tuple[str, str], Decision] = {}
+    delegated: list[CaseEvaluation] = []
+    for evaluation in evaluations:
+        if evaluation.decision is None:
+            continue
+        key = (_delegation_correlation(evaluation.case), evaluation.case.subject.id)
+        decisions[key] = evaluation.decision
+        if evaluation.case.subject.delegated_by and evaluation.decision is Decision.ALLOW:
+            delegated.append(evaluation)
+
+    findings: list[Finding] = []
+    for evaluation in delegated:
+        correlation = _delegation_correlation(evaluation.case)
+        for delegator_id in evaluation.case.subject.delegated_by:
+            if decisions.get((correlation, delegator_id)) is Decision.DENY:
+                findings.append(
+                    Finding(
+                        kind=FindingKind.INVARIANT_VIOLATION,
+                        severity=Severity.CRITICAL,
+                        case=evaluation.case,
+                        message=(
+                            f"Delegated principal {evaluation.case.subject.id!r} is allowed where "
+                            f"delegator {delegator_id!r} is denied (privilege escalation)"
+                        ),
+                        candidate=evaluation.decision,
+                        invariant="delegation",
+                    )
+                )
+    return minimize_findings(findings)
+
+
 def comparison_findings(comparisons: Iterable[ComparisonResult]) -> list[Finding]:
     """Convert changed decisions into minimized security findings."""
     findings: list[Finding] = []
@@ -147,5 +256,4 @@ def finding_equivalence_key(finding: Finding) -> tuple[object, ...]:
 
 def finding_case_complexity(finding: Finding) -> tuple[int, str]:
     """Order reproductions by compact canonical case representation."""
-    serialized = json.dumps(finding.case.to_dict(), sort_keys=True, separators=(",", ":"))
-    return (len(serialized), serialized)
+    return _case_complexity(finding.case)