LEXCAP: Transaction-Consistent State-Bound Capabilities for Auditable Legal-Resource Access

Abstract

Digital legal proceedings require authorization decisions that remain valid while participant status, matter association, privilege, protective-order restrictions, and document classifications change. A signed bearer token can be authentic yet stale, while a matter-wide revocation epoch prevents stale use only by invalidating unrelated grants. This paper presents LEXCAP, a state-bound capability architecture that evaluates identity, association, privilege, restriction, policy, and nonce state under one optimistic serializable transaction. It derives an authorization-state fingerprint (ASF) from deterministic material projections, authorization-relevant versions, request binding, policy and dependency digests, and a one-time issuance nonce. The fingerprint is embedded in an Ed25519-signed capability, re-created before access, and linked to an encrypted, quorum-signed audit chain. We implement a controlled Python prototype with SHA-256, AES-256-GCM, four ledger validators, and a synthetic legal-document corpus containing 600 participants, 80 matters, 8,000 resources, and 20,120 state records. Across five fixed seeds, LEXCAP rejected all 1,500 capabilities affected by relevant post-issuance revocations while retaining all capabilities after administrative or unrelated same-matter changes. It detected every one of 1,250 issuance races, rejected every duplicate-nonce issuance, reconstructed all 1,500 audited decisions, and localized every injected state divergence. Median end-to-end issue-and-validation latency was 1.165 ms, with 2.001 ms at the 95th percentile and 639 request pairs/s on a five-vCPU host.