# Deterministic Agent Authorization — Decionis Reference

Canonical URL: https://decionis.com/reference/agent-authorization

A fail-closed execution boundary that captures one exact agent intent, evaluates policy, and grants authority for that exact downstream mutation at most once.

## Fail-closed invariant

- Capture one immutable agent-safe.intent/1 binding before policy evaluation.
- Hash its recursively key-sorted canonical JSON with SHA-256.
- Run POST /v1/authority/enforce-and-bind in ENFORCEMENT mode.
- Only ALLOW may carry a short-lived, intent-bound, Ed25519 execution grant.
- BLOCK, ESCALATE, REVIEW_REQUIRED, errors, expiry, replay, and binding mismatch authorize nothing.
- Atomically consume the grant immediately before the downstream mutation.

## Canonical endpoints

- POST /v1/authority/enforce-and-bind — Recompute the canonical intent hash, evaluate policy, and mint a grant only for ALLOW.
- POST /v1/execution/verify-token — Inspect signature and binding without authorizing execution.
- POST /v1/execution/consume-token — Atomically redeem the exact grant once immediately before mutation.

## Immutable intent example

The example hash is the actual SHA-256 of the canonical JSON binding, not placeholder text.

{
  "protocol_version": "agent-safe.intent/1",
  "tenant_id": "00000000-0000-4000-8000-000000000001",
  "intent_id": "00000000-0000-4000-8000-000000000002",
  "captured_at": "2026-08-15T12:00:00.000Z",
  "expires_at": "2026-08-15T12:01:00.000Z",
  "actor": {
    "id": "refund-agent",
    "type": "ai-agent",
    "runtime": "langchain",
    "trust_level": "service"
  },
  "action": {
    "type": "refund_order",
    "resource": "shopify:order:58291",
    "parameters": {
      "amount": 350,
      "currency": "USD"
    }
  },
  "context": {
    "campaign": "reference-vault",
    "customer_tier": "standard"
  },
  "downstream_target": {
    "system": "shopify",
    "operation": "refund",
    "endpoint": "/admin/api/2026-07/orders/58291/refunds.json"
  },
  "intent_hash": "sha256:b26e308e446057281f305332790935ad95b5f2f87d1c89e7c08c54178ba236a4",
  "mode": "ENFORCEMENT"
}

## Framework enforcement boundaries

- LangChain.js / LangGraph.js — @decionis/langchain: Wrap every mutation-capable tool; blocking verdicts short-circuit before invocation.
- CrewAI / Python tool runtimes — Generic @decionis/sdk execution-authority recipe; no native CrewAI adapter: Call enforce-and-bind, consume the grant, then invoke the tool; any error stops execution.
- Claude Code, Codex, and GitHub Copilot — @decionis/mcp native PreToolUse hooks: Install the native hook so enforcement occurs outside model discretion.
- Claude Desktop and MCP clients without binding hooks — @decionis/mcp discovery tools: MCP tools are advisory unless the host routes mutations through an external execution-authority gateway.

## Signed evidence

Decision Dossiers use canonical SHA-256 artifacts and detached Ed25519 signatures. Use the public JWKS and live or offline verifier; example response files are explicitly contracts, not fabricated live signatures.

{
  "example_kind": "verification-contract-not-a-live-signature",
  "canonicalization": "Recursively sort object keys using ECMAScript UTF-16 code-unit ordering, then JSON.stringify the result as UTF-8.",
  "digest": "SHA-256",
  "signature": "Ed25519",
  "public_jwks": "https://api.decionis.com/v1/.well-known/decision-dossier-jwks.json",
  "execution_grant_jwks": "https://api.decionis.com/v1/.well-known/decionis-execution-grant-jwks.json",
  "live_verification": "https://decionis.com/verify/decision-dossiers",
  "offline_verifier": "npx -y @decionis/verify <dossier-url-or-json-file>",
  "checks": [
    "Select an OKP/Ed25519 JWK whose kid matches the proof bundle key_id.",
    "Recompute each portable artifact's canonical SHA-256 digest.",
    "Verify every detached Ed25519 signature over those canonical UTF-8 bytes.",
    "Reject missing, mismatched, malformed, or unverifiable proof."
  ]
}