Skip to content
auths/

Action binding

Concept / exact bytes

The core verifier does not understand MCP arguments, deployment strategies, or HTTP methods. An application profile owns that semantic mapping and produces a CanonicalAction.

The action binds:

  • profile identifier and version;
  • media type;
  • capability and resource;
  • requested budget;
  • audience and challenge;
  • validity;
  • canonical body digest; and
  • profile-defined constraints.

Changing one covered field produces a different action. An approval for one artifact, environment, tool call, or request cannot be reused for an adjacent operation.