Technical note·Sep 8, 2026·9 min read

Execution Authority: implementation, not aspiration.

In one week Broadcom, JetStream and ChainIT each moved to the execution-time boundary. Good: the category exists. This note compares what each announcement establishes against twelve capabilities of an execution authority, cites the primary source for every cell, and shows the same protocol reaching agents, runtimes and enterprise systems — with the corpus and verifier that let you check the Decionis column yourself.

Festus Jejelowo · Decionis, Inc. · ORCID

One week, three announcements

Between 31 August 2026 and 2 September 2026 three companies published the same boundary. Broadcom made AgentMinder generally available: each agent action is authorised against its declared mission, intent, context and risk before it reaches an enterprise resource, with existing authorisation infrastructure reused through AuthZEN and an OpenTelemetry audit trail (Broadcom — unveils AgentMinder (investor-relations release), 31 Aug 2026, retrieved 7 Sep 2026). JetStream announced Clearance, which evaluates every agent action at the gateway before it runs, down to tool parameters and across sequences of actions, against a versioned contract it calls an AI Blueprint (JetStream — Clearance: zero trust for AI actions (announcement), 2 Sep 2026, retrieved 7 Sep 2026). And ChainIT published Provable Authority and the ChainIT Authority Protocol: authority determined before one exact action, a canonical transaction digest over the material fields, human step-up, single-use execution authorisation and an append-only record of what was authorised and what occurred (ChainIT — launches Provable Authority (announcement), 2 Sep 2026, retrieved 7 Sep 2026).

We are encouraged by this. Independent teams arriving at authority at execution time is how a category gets drawn, and each of these announcements says, in its own vocabulary, that a valid credential and a safe-looking prompt are not the same thing as authority for the action about to happen. That is the argument this site has been making, and it is better made by four companies than by one.

So this note is not a rebuttal. It is a matrix. Our focus has moved to the harder question: once the action has executed, how does anyone prove that the action which ran remained the action that was authorised — and who is allowed to check? Gateway authorization is not execution-bound authority. The rows below are the capabilities that question turns on. Every Decionis cell links the artifact that implements it. Every vendor cell either cites the announcement that states it or reads “not found in reviewed public materials” — because a company may well implement something it has not yet published, and this note only reads what is public. Checked 2026-09-07.

Twelve capabilities, four columns

ChainIT: The whitepaper is behind a form and the developer documentation URL linked from the announcement returned 404 on the review date, so the column reads only the announcement. Broadcom: Read from the investor-relations release and its newswire syndication; product documentation was not part of the review. JetStream: Read from the launch announcement; the product is pre-GA and no technical documentation was published with it.

Capability	Decionis	ChainITProvable Authority and the ChainIT Authority Protocol	BroadcomAgentMinder	JetStreamClearance
Pre-execution authorizationIs the action decided before it executes, rather than logged after?	implementedEvery consequential action is evaluated against the organisation's own policy bundle before commit and answered ALLOW, ESCALATE or BLOCK. Execution Authority	statedAuthority is determined before one exact action executes.	statedEach agent action is authorised before it reaches an enterprise resource.	statedEvery agent action is evaluated before it runs.
Deterministic, versioned policyDoes the same policy revision and the same inputs always give the same verdict?	implementedThe verdict is a deterministic function of the policy revision, the request and the supplied facts; policy revisions are immutable and the revision is recorded in every dossier. Policy decision graph	statedDeterministic pre-execution controls over versioned authority policies are stated.	not foundnot found in reviewed public materials; Authorisation against mission, intent, context and risk is stated; the evaluation method is not.	not foundnot found in reviewed public materials; The Blueprint is versioned; evaluation is described as a reasoning engine, and determinism is not stated.
Exact-action bindingIs the authorisation tied to the exact material fields of the action that will execute?	implementedExecutionBinding 1.0 binds the dossier to the canonical payload digest, execution target, policy identity and digest, material signals, validity window and nonce. Execution authority evidence	statedA canonical transaction digest binds payer, payee, destination, amount, currency or asset and rail.	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials; Tool parameters are evaluated; a commitment carried to the downstream execution is not described.
Canonical payload commitmentIs the digest computed over a published canonical form, so anyone can recompute it?	implementedPayloads and bindings are canonicalised with RFC 8785 (JCS) and digested with SHA-256; the profile is named inside the dossier so a verifier recomputes it without asking Decionis. Verify a Decision Dossier	not foundnot found in reviewed public materials; A canonical digest is stated; the canonicalisation profile and algorithm are not.	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials
Pre-commit revalidationImmediately before commit, is the authorisation checked again against current policy and signals?	implementedThe claim step revalidates the signed dossier, the current policy revision, material signals, human approval, target, payload, expiry and nonce before the action is released. Claim before commit	not foundnot found in reviewed public materials; Single-use authorisation is stated; a revalidation step at commit is not.	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials
Replay-resistant, single-use grantCan an authorisation be presented twice, or for a different action?	implementedEach grant carries a nonce that is claimed once, within a lease; a second claim, an expired lease or a substituted payload is refused and recorded. Execution authority evidence	statedSingle-use execution authorisation is stated.	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials
Human authority bound to the actionWhen a person approves, is the approval tied to the exact action, not to a session?	implementedPresence resolves an ESCALATE with a verified human whose approval carries the action's binding digest and is revalidated before the nonce is claimed. Presence	not foundnot found in reviewed public materials; Human step-up is stated; that the approval is bound to the transaction digest is not.	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials
Effect evidenceAfter execution, is the observed outcome recorded with a digest of the actual response?	implementedFinalisation records CONFIRMED, FAILED or INDETERMINATE with the request digest, a response digest for confirmed effects, the observer and its version, and how the effect was observed. Effect evidence	not foundnot found in reviewed public materials; An append-only record of what was authorised and what occurred is stated; a response digest is not.	not foundnot found in reviewed public materials; An OpenTelemetry audit trail is stated.	not foundnot found in reviewed public materials
Signed input snapshotAre the exact inputs the verdict was reached on signed alongside the verdict?	implementedThe inputs snapshot is built once, signed with the dossier and stored verbatim, so a verifier can replay the decision from what was actually evaluated. Decision Dossier	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials
Offline verificationCan a party who does not trust the operator verify the evidence with the service off?	implementedAn open verifier checks the Ed25519 signature, recomputes the digests and refuses the negative cases, from two files and a published key set, with no account and no call to Decionis. Verify without an account	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials
Portable SCITT-profile evidenceCan the evidence leave the vendor's format and be checked by someone else's tooling?	implementedA dossier and its execution lifecycle export to the SCITT Agent Action Capsule draft-04 profile with a COSE-signed producer envelope; a draft-pinned compatibility claim, not conformance to a published standard. SCITT-compatible export	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials
Public verification corpusIs there a published corpus a reviewer can run the verifier against today?	implementedA synthetic corpus of signed dossiers, including the cases a verifier must refuse, is archived with a DOI under Apache-2.0 with its signing key deliberately published. Corpus DOI	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials	not foundnot found in reviewed public materials

“Stated” means the cited announcement establishes the capability; the cell also says where the statement stops. “not found in reviewed public materials” is exactly that, and not a claim that the vendor lacks it.

What the rows add up to

Read down the Decionis column and the twelve rows are one lifecycle. An intent becomes a deterministic verdict; the verdict is bound to the exact action; the binding is claimed once, immediately before commit; the action executes; the observed effect is recorded with a digest of the real response; all of it is signed together; the record can leave in a standards-profile envelope; and anyone can verify it with our service switched off.

01Intent — an agent, workflow or person proposes one exact action
02Deterministic authority — policy revision + request + supplied facts → verdict
03ExecutionBinding — verdict bound to payload digest, target, policy, signals, nonce
04Pre-commit claim — single-use claim, revalidated against current state
05Execution — the downstream system performs the bound action
06Effect evidence — observed outcome with request and response digests
07Signed dossier — Ed25519 over inputs, verdict, binding and effect
08SCITT capsule — optional draft-04 export with a COSE producer envelope
09Offline verification — anyone recomputes and refuses, with the service off

Authority that survives the execution boundary.

The lifecycle is numbered because the order is the point: each artifact commits to the one before it, which is what lets the last step happen without trusting the party that ran the first eight. Vendors converging on the execution-time boundary validate the category; the question that remains is whether the action that executed stayed the action that was authorized, and who can check.

Multiple enforcement surfaces, one authority protocol.

An authority protocol that lived in one gateway would be a gateway. The same semantics — the same verdicts, the same binding, the same dossier — reach the places agents, runtimes and enterprise systems actually execute. Each row’s status is read from the registry that owns it, so this table cannot promise a surface the registry does not.

Surface	Role	Status
AgentsAgent-Safe Pipeline	Open reference implementation of exact-action authorization, lifecycle enforcement and audit evidence for agent pipelines.	Apache-2.0 · v0.1.3
Claude and ChatGPT connectors (MCP)	Authority where agents invoke tools: a decision before the tool call, from inside the assistant.	production · installable
RuntimesDocker Desktop	Local and container execution: live decision evaluations and offline dossier verification inside the developer's runtime.	installable
EnterpriseUniversal Commerce Protocol checkout	Agentic commerce execution: an authority decision bound to the exact checkout before the merchant commits.	reference published
Enterprise adapters	Business-system execution: SAP and ServiceNow, and the Zapier and n8n automation connectors, gated at the consequential-action boundary.	validated · production
Human authorityPresence	Human authority bound to the action: a verified person resolves an ESCALATE, and the approval carries the action's binding digest.	live
EvidenceDecision Dossier corpus and verifier	Independent evidence verification: the public corpus and the open verifier reproduce every check with the service off.	@decionis/verify@0.2.0 · DOI 10.5281/zenodo.22312956

No identity provider, gateway, agent framework, cluster or enterprise application has to be replaced: the same execution-authority protocol sits at the consequential-action boundary in each of them.

Standards, drawn outside the architecture

None of the above depends on a standards body, and we keep it that way on purpose. Where Decionis touches a standard it is as a crosswalk, a contribution or a compatibility profile, and each relationship is stated in the one sentence it can bear:

Agent Baselinecontributioncontributed 1–2 Sep 2026; proposal #31 opened 1 Sep 2026
Decionis contributes implementation experience to the Agent Baseline project.
AUT-05: an exact and independent approval test method (#28)
EMVCo Agentic Payments frameworkpublic comment6 Sep 2026
Decionis filed a public comment on the draft framework on 6 September 2026 (EMVCo query 20260906-BFF787). Decionis is not a member, subscriber or associate of EMVCo.
The comment as filed
Universal Commerce Protocol (UCP)compatibility6 Sep 2026
Decionis publishes an execution-authority extension and a checkout authorization contract for UCP releases from 2026-01-23 onward. Decionis is not a member or maintainer of UCP.
UCP execution authority reference
SCITT Agent Action Capsule (IETF draft-04)compatibility31 Aug 2026
Decision Dossiers export to the draft-04 JSON profile with a COSE producer envelope; a draft-pinned compatibility claim, not conformance to a published standard.
Execution authority evidence
OpenID AuthZEN Authorization API 1.0plannedplanned as of 7 Sep 2026
An input adapter that carries an enterprise policy decision point's AuthZEN answer into evaluation as a material signal is planned; AuthZEN is an input to authority, never the protocol core. Decionis is not a member of the OpenID Foundation.
AuthZEN 1.0 (final, January 2026)

Check the Decionis column yourself

Don’t take the left-hand column on trust either. The public corpus — v0.1.3, Apache-2.0, archived with DOI 10.5281/zenodo.22312956 — and the open verifier @decionis/verify reproduce every check in the offline verification row, including the negative cases a verifier must refuse. Download the evidence, leave our service out of the loop, and verify the decision:

npx -y @decionis/verify \
  --file dossiers/vectors/owned-execution-bound.json \
  --jwks dossiers/corpus-jwks.json

The corpus proves the verifier; a production dossier verifies against the live key set, and the technical note walks through both. If a row in the Decionis column does not survive that exercise, the row is wrong and we will correct it.

Sources

ChainIT — launches Provable Authority (announcement) — 2 Sep 2026, retrieved 7 Sep 2026
Broadcom — unveils AgentMinder (investor-relations release) — 31 Aug 2026, retrieved 7 Sep 2026
GlobeNewswire — the same release, syndicated — 31 Aug 2026, retrieved 7 Sep 2026
JetStream — Clearance: zero trust for AI actions (announcement) — 2 Sep 2026, retrieved 7 Sep 2026

We are not a member, partner or certified implementer of any standards body named above. Vendor statements are read from the cited announcements on 2026-09-07 and re-checked as they are touched; if you are one of the vendors and have published something the matrix does not reflect, send the link and the cell will be updated with the citation.

Loading…