Mental model

Concept / authority path

01 / Trust

Trusted root

Authority starts from a verifier-configured anchor.

narrows

02 / Delegate

Bounded grant

Capability, resource, audience, and time become tighter.

binds

03 / Execute

Exact action

The verified bytes become the only executable command.

1. Trust is an input

The verifier receives trust anchors, accepted registries, time, audience, challenge, status snapshots, assurance policy, and resource limits through an immutable VerifierContext. It does not discover them from the environment.

2. Delegation attenuates

A child grant must remain inside the authority of its parent. Permissions, resource namespaces, audiences, validity, budget ceilings, delegation depth, status policy, and assurance requirements can stay equal or become narrower. They cannot expand.

3. An action is canonical

An application profile converts security-relevant request data into one canonical action. The action commits to the profile, capability, resource, audience, challenge, body digest, constraints, and validity.

4. Verification seals the result

The native pipeline is:

untrusted bytes
  -> DecodedProof
  -> ResolvedProof
  -> ControlVerifiedProof
  -> VerifiedAuthority
  -> VerifiedAction

VerifiedAction has no public constructor. Only the complete verifier pipeline can produce it.

action: tools/call · database.query
audience: mcp://analytics-service
authority: root → orchestrator → agent
constraints: read-only · 500 rows

5. Execution uses the sealed action

The profile decodes the command from VerifiedAction. Executors never receive the original request bytes as their authorized command.