Authorization That Survives Disconnection: Capability-Based Security and Portable Evidence for the Cloud-Fog-Edge Continuum

Authorization in Internet of Things deployments assumes a reachable cloud; the cloud-fog-edge continuum breaks that assumption where decisions matter most. This article presents a delegation architecture in which authority is granted at the cloud and attenuated tier by tier down to fog nodes, gateways, and constrained devices, with caveats for topic scope, rate, geofence, and validity window. The architecture requires every tier to verify locally and offline, binds requests to the leaf key, bounds revocation by epochs and expiry, and records decisions as hash-chained evidence. A Python reference implementation realizes verification, request handling, revocation, and evidence; the device-tier verifier and the attested OP-TEE fog verifier are specified, not built. In a medical IoT scenario, CBOR-encoded chains fit CoAP without block-wise transfer up to depth 4 and a negotiated BLE notification at depth 1; on LoRaWAN only a depth-1 chain fits, at the fastest data rates without repeaters, so LoRa-class links need session-anchored authorization. Under hour-long disconnection, authorization availability is 0.93–0.98 for expiry horizons of 8 h or more, and a credential revoked while still valid stays honored for 32–33 min. On three Raspberry Pi boards, chain verification costs 327–645 μs per hop, under 4 ms at depth 6, and about 0.38 mJ per hop.