Certification answers a question that sits before the nine gates: may this
agent hold authority in the first place?
The gates ask whether a particular action is permitted under a particular grant.
Certification asks whether the agent was ever fit to be granted anything. An
uncertified agent can be issued authority in observe, because observing costs
nothing, and cannot be promoted to a rung that refuses.
What a certificate records
The hashes are the point. A certificate that does not pin what it certified is
an opinion with a date on it.
Four places it is enforced, not two
The check is one function called from every path that issues or escalates
authority:
The first implementation covered two of these, and the two it missed were the
two that mattered.Delegation hands enforcing authority to an agent nobody checked.
Attenuation does not help: a child that is a strict subset on all five axes
still runs different tools under a different provenance.Promotion is the exact transition this exists for. Issue in observe, which
needs no clearance by design, then promote. A control with a two-step path
around it is worse than no control, because the console reports the grant as
enforcing either way.
The API
Revoking
Revocation is a first-class field rather than a delete. A certificate that was
valid and then was not is a fact about a period of time, and deleting it would
destroy the only record that the agent was ever cleared. 
