AgentEnvelope Working draft

Agent Envelope · The Pre-Action Verdict for Agent Actions

Signing the Verdict Before the Action Runs

Reputation and receipts record what an agent did, after the fact. The Attested Action Envelope records what an agent may do — a signed verdict issued before the action runs, with refusals preserved as first-class evidence.

An action is authorized when a verifier can check, from a single signed object, that a policy decided it before it ran — not infer authorization from the fact that nothing stopped it. The Attested Action Envelope (AAE) is that object: an eight-field record naming the agent, the action, the policy that decided, and the verdict, signed with Ed25519 and chained by hash to the agent's previous envelope. A denied verdict is a fully signed envelope too — a refusal is provable, not a silent absence.

What is the Attested Action Envelope →    The primitives →

What the envelope binds

Every Attested Action Envelope carries exactly eight fields. Nothing optional, nothing implicit — a document with an extra member, a missing one, or an outcome outside the closed set is not an envelope and fails verification.

Agent & action

Who asked, to do what

agent_id names the acting agent. action is {verb, resource, params} — what it asked to do.

Policy

Which policy decided

policy_id names the policy entry that produced the verdict. sm-aae does not evaluate policy itself — the caller supplies both policy_id and outcome.

Verdict

Authorized, denied, or conditional

outcome is one of authorized, denied, or conditional. Refusals are first-class signed envelopes, not a silent absence.

Chain

Linked to what came before

prev_hash is the hex SHA-256 of this agent's previous envelope, or null for its first. Deleting or reordering an interior envelope breaks the chain.

Provenance

When, and by whom

issued_at is an RFC 3339 timestamp. sig is the Ed25519 signature over the canonical envelope; pubkey is the signer's raw Ed25519 public key.

Refusals are first-class

When a system declines an action, it typically just doesn't do it — there is no signed artifact that says "we were asked, and we said no, here, then." A denial is a silent absence, indistinguishable later from "never asked." A denied verdict produces a fully signed envelope, identical in shape to a grant. The refusal becomes a durable, verifiable receipt: an audit can count and inspect refusals the same way it inspects grants.

Out of scope. The envelope answers "was it authorized?" — not "did it happen?". A signed AAE proves a policy decision was made, by whom, and when; it says nothing about whether the agent went on to actually perform the action. That's the occurrence half of the accountability question, and it belongs to agency receipts — the companion signed record an agent emits when it acts. AAE and receipts answer different questions about the same action.