Any latch can be extended into a child. The child inherits the parent's policy and can only tighten it. One credential fans out into progressively more restricted tokens: a team latch, then a per-service latch, then a per-agent latch, each strictly less powerful than its parent.
Extended latches appear under Delegated on the Latches page.
The chain is resolved live
A child does not copy its parent's policy. It resolves the chain at request time. Tighten the parent and every descendant tightens on its next request. There is no redeployment and no re-issuing of tokens.
That is what makes revocation work: disable a latch high in the chain and everything below it stops, immediately.
How the policies compose
Every latch in the chain contributes its filters, root first, and the matched mount's pipeline runs last. First deny wins:
grandparent latch-level pipeline
-> parent latch-level pipeline
-> child latch-level pipeline
-> the matched mount's own pipeline
A child cannot remove a parent's filter. It can only add more.
Mutability
A parent controls how much a child is allowed to change:
| Mode | Meaning |
|---|---|
open |
The child may modify its inherited policy. |
attenuate_only |
The child may only make the policy stricter. |
locked |
The child may not change the inherited policy at all. |
Inheritance mode
| Mode | Meaning |
|---|---|
live |
The chain is resolved on every request. A parent's change reaches the child immediately. |
snapshot |
The child keeps the policy as it was when it was created. |
live is what you want for revocation to be instant. snapshot is for when a
descendant must not be surprised by a change upstream of it.
Inheriting a mount table
If an ancestor is a multi-mount latch, the child routes through that mount table and can narrow it: remove a mount, or append filters to an inherited mount's pipeline. It cannot change an inherited mount's upstream or secret; those belong to the ancestor.
The four restrictions that apply while the extension path is being built out are documented in Multi-mount latches.
Seeing the shape of it
A latch's detail page shows its parent chain: what it inherited, and what it narrowed on top.