Agent governance
Identity, authority and deterministic policy
Three questions are answered before an action is transmitted: who is acting, what are they permitted, and does the active policy allow this specific request. None of the three is answered by the agent itself.
What is established, and from where
Identity comes from the transport, not the payload
The acting agent is derived from the authenticated credential presented at the connection. A field in the request body claiming an identity is ignored, because anything able to write the body could write that field.
Authority is resolved, not asserted
Whether this agent may perform this action, on whose behalf, and within what bounds is looked up in the authority model. Delegation is explicit and bounded rather than inherited by default.
Policy is deterministic and versioned
Rules are evaluated, not judged. The same request against the same policy version produces the same decision every time, and the policy version is recorded in the evidence.
The decision happens inside the write transaction
Reading the policy and committing the action share a transaction, so a policy edit cannot land in the gap between them. Work already approved is re-decided at dispatch against the policy in force then.
Verdicts
Agent identity from authenticated context
ProvenAn agent's identity and its accountable owner come from the authenticated credential and the agent directory. They are never read from the request body. A request whose body disagrees with its credential is refused, and the refusal itself is recorded as signed evidence.
Deterministic policy enforcement
ProvenDecisions are produced by explicit rules over an explicit policy document with a version, not by a model's judgement. The same request under the same policy version yields the same decision, and the policy version that governed each decision is recorded in the signed evidence.
Revocation of agent authority
ProvenAn authorized operator can revoke an agent. Its next request cannot execute, and an action it had already had approved but not yet dispatched cannot execute either — revocation reaches work already in flight, not only new requests.
The honest boundary
This governs what an agent is permitted to do. It does not make an agent's reasoning correct, and it does not detect that a permitted action was requested for a bad reason. A well-formed, fully authorized, entirely wrong decision still executes.