Access is not authority
Identity and access establish the actor and general entitlements. They do not authorize this refund, deployment, payment, or infrastructure mutation now.
Loading…
API documentation
Execution Authority Evidence
A reproducible synthetic refund traces the exact action from customer policy and Presence approval through a single-use grant, observed commit, signed evidence identity, draft-04 Capsule, and producer signature. Transparency anchoring remains a separate, receipt-backed claim.
The control stack
Each layer answers a different question. Inputs become authority only at the execution-bound decision point.
Identity → Access → Semantic Security → Execution Authority → Human Authority → Execution → Verifiable EvidenceIntent detection is not authority
Semantic-security detectors contribute typed, provenance-bearing risk signals. Customer policy—not a detector or model—determines ALLOW, ESCALATE, or BLOCK.
Approval must be execution-bound
A Presence approval becomes usable authority only after it is cryptographically bound to the exact action and incorporated into a newly evaluated, single-use grant.
One linked example
The public JSON artifact contains every identifier and digest below. It is synthetic, stable, and checked against the protocol mapper and offline verifier in the test suite.
| Stage | Linked evidence |
|---|---|
| Bound grant | Dossier 22222222-2222-4222-8222-222222222222; payload, target, binding, nonce, and correlation digests. |
| Human authority | Presence receipt presence-dossier-4242 and its exact action-binding digest. |
| Execution | COMMITTED claim with gate-observed CONFIRMED request and response digests. |
| Decision Dossier | The same dossier and evaluation identities carried by the execution binding and commit evidence. |
| Agent Action Capsule | Capsule 61293a3b5b44ca871166fa3cad8721a916d30c9059690bb537301f19f7fe56b6, reproducible with RFC 8785/JCS and SHA-256. |
| Producer signature | Tagged COSE_Sign1 over the raw Capsule ID, signed by the fixture Ed25519 key and verifiable offline. |
| Transparency receipt | Not present in this example; receipt_verified=false, anchored=false, attestation=self_attested. |
Machine-readable artifact
https://decionis.com/reference/execution-authority-evidence.json is the canonical public fixture. The absence of a receipt is deliberate: a producer signature is not a Transparency Service anchor.
Verify offline
The public @decionis/verify package recomputes the Capsule ID and verifies the tagged COSE_Sign1 without a Decionis account or API call.
import {
verifyAgentActionCapsuleV04Class1,
verifyAgentActionCapsuleProducerEnvelope,
} from "@decionis/verify";
const evidence = await fetch(
"https://decionis.com/reference/execution-authority-evidence.json",
).then((response) => response.json());
const capsule = evidence.agent_action_capsule;
const class1 = verifyAgentActionCapsuleV04Class1(capsule);
if (!class1.ok) throw new Error("Capsule identity or invariants failed");
const envelope = Buffer.from(
evidence.producer_envelope.cose_sign1_base64url,
"base64url",
);
const producer = verifyAgentActionCapsuleProducerEnvelope(
envelope,
capsule.capsule_id,
);
if (!producer.ok) throw new Error("Producer signature failed");
if (evidence.transparency_service.anchored) {
if (!evidence.transparency_service.receipt_verified) {
throw new Error("Unearned transparency anchor claim");
}
}Verifier package: @decionis/verify
Claim boundaries
Compatibility, producer authentication, and transparency anchoring are independent layers.
| Claim | What is earned |
|---|---|
| SCITT-compatible export | Decionis exports the SCITT Agent Action Capsule draft-04 JSON profile. This is a draft-pinned compatibility claim, not a claim of conformance to a published standard. |
| COSE-signed | A draft-04 tagged COSE_Sign1 Producer Envelope signs the raw Capsule ID with Ed25519. Signature validity authenticates the enclosed key; operator authorization is a separate trust decision. |
| Anchored only with a verified receipt | A Capsule is described as anchored only when a Transparency Service receipt is present and verified. A Capsule or valid producer signature without that receipt remains self-attested. |