A stolen bearer token survives your region, client and protocol blocks — which control class remains?

## What "bearer" actually means A bearer credential is one where **presentation is the whole proof**. The validator checks that the artefact is well formed, unexpired, correctly signed by its issuer and scoped to this audience — and then serves whoever sent it. It does not, and cannot, ask whether the sender is the party the credential was issued to. That is not a bug in any particular product; it is the definition of the credential type, and it is why a copied bearer token is a working credential in anyone's hands. Every other fact about the replay is decoration. The client library, the user agent string, the source address, the access surface — all of them are the sender's to choose, and choosing differently costs a setting or the rent on a host. So a sequence of blocks aimed at those produces a sequence of small delays and then the same outcome. ## Deriving the control class from the precondition The derivation is mechanical once the precondition is named. The precondition is *possession equals authority*. Therefore the control class is anything that makes possession insufficient. **Proof of possession (binding).** The token is issued against a key pair whose private half stays with the legitimate client. Every request carries a fresh signature over that request made with the private key, or the connection itself is authenticated with the client's certificate and the token records the certificate's thumbprint. Two published schemes do this for OAuth-style credentials: mutual-TLS client-certificate-bound access tokens (RFC 8705), where the token is bound to the TLS client certificate, and DPoP (RFC 9449), where the client sends a signed proof header alongside the token. In both, copying the token alone yields nothing, because the thief has the artefact and not the key. This is a **removal**: the property that made the copy valuable is gone. **Short lifetime.** A credential that lives minutes rather than months means the copy is stale before it can travel. This is a **price**, not a removal — a credential stolen and used in its first minute replays perfectly. What it does destroy is any model built on the credential still working later, which matters a great deal against resale. **Scope reduction.** Cutting the rights the credential carries changes what a successful replay reaches. It does not touch replayability at all; it changes the consequence. Worth doing, wrong to present as the answer. ## Why rotation is not on this list Rotation replaces the instance and leaves the class untouched. The new token is still accepted from whoever presents it, so the next copy replays exactly as the last one did. Rotation on a schedule is really a lifetime argument wearing different clothes: it bounds how long one theft stays useful. It never converts possession into something the thief must also prove. ## When binding is unavailable Some integrations cannot hold a private key: a third party's platform that only speaks bearer, an appliance with no key store, a partner who will not change their client. Two honest moves remain. Issue short-lived credentials derived from a longer-lived secret that lives somewhere the client cannot leak, so the artefact in flight is the cheap one. And reduce what the credential can reach, so a replay lands somewhere smaller. Then write the residual down explicitly: *this path remains bearer; we priced it, we did not remove it.* An architect who says that is trusted more than one who reports the path mitigated. ## Reading the whole answer back The shape of a good answer here is three sentences. Name the swappable set and price it at roughly zero. Name the single surviving precondition in the language of the credential type, not the language of the incident. Then name the control class that makes that precondition false, and separate cleanly the controls that remove it from the ones that merely shorten the window. Interviewers are listening for that separation — it is the difference between someone who collects controls and someone who derives them.