Loading…
Open implementation specification · v1
Agent-Safe Intent records the actor, tenant, proposed parameters, expiry and downstream target before an action is authorized. The executor must check the binding again before commit. A scope-bearing access token alone does not express this binding.
This documents agent-safe.intent/1 from the Apache-2.0 Agent-Safe reference implementation. It is an implementation specification, not an independent standards certification. Updated 2026-09-16.
An agent proposes an action. The trusted capture layer supplies identity, time, destination and execution context. Credentials stay outside the proposal. A hash establishes a binding; it does not authenticate the proposal or authorize execution by itself.
Recursively rebuild objects with keys sorted by JavaScript UTF-16 code-unit order, preserve array order, then apply JSON.stringify. JavaScript integer-index property ordering still applies. Encode the resulting string as UTF-8, hash with SHA-256, and prefix the lowercase hex digest with sha256:.
Do not normalize Unicode. Composed and decomposed strings remain distinct. JavaScript JSON number encoding applies: negative zero becomes 0 and 1e21 becomes 1e+21. This is not a claim of RFC 8785 compatibility. Cross-language implementations must match the supplied bytes.
The reference rejects cycles, forbidden prototype keys, non-finite numbers and unsupported values. Capture bounds depth to 20, total entries to 5,000, arrays to 1,000 and serialized data to 100 KB. Treat these as the reference implementation's limits, not permission to accept untrusted identities.
These are synthetic public test inputs. Each JSON contains the binding, expected canonical JSON and expected digest. Passing these vectors demonstrates byte compatibility for these cases, not a complete security review.
Apache-2.0 license · Upstream vectors · Reference implementation
A framework name is not a test result. None of the six framework adapters below has a measured conformance result published here yet. To submit one, include the adapter and dependency versions, command, commit, vector output, and negative tests for changed parameters, expired authority and duplicate execution.
2026-09-16: first web publication of v1 and seven existing reference vectors. Breaking changes to binding or canonical bytes require a new protocol version and new vectors. Propose a change with motivation, backward compatibility, trust-boundary impact and test vectors in an upstream issue. Independent implementations are welcome.