Verifier limits

Reference / auths-model

VerifierLimits configures bounded decoding and verification for:

• bundle, evidence, signature, extension, canonical-body, and attachment bytes;
• grants, actions, plan leaves, plan depth, and plan branching;
• evidence objects and control bindings;
• principal and grant status statements;
• attachments and signatures;
• permissions, audiences, extensions, and body digests;
• registry entries and trust anchors; and
• total verification work units.

The model exposes default_deployment() and hard validation around acceptable limits. Applications may choose tighter limits. Raising limits is an explicit local security decision.

Failure behavior

An input exceeding the configured bound fails closed with a stable protocol result such as resource-limit-exceeded. Limits are checked before unbounded allocation or cryptographic work.

Automation target

The documentation generator inventories LimitKind today. A follow-up repository-owned cargo xtask docs-export should emit exact default and hard numeric values without parsing Rust source text.