A person in a workspace can now give an artificial intelligence agent a bounded authority to pay or share data with one company, approve what it asks for above those limits, and revoke it. Trooth signs a receipt for each delegation and a ten-minute evidence reference for each authorized action.
What changed
Agent authority is on for every workspace. A delegation names one agent by the thumbprint of its key, the role it acts in, the one company it may act with, whether it may pay (up to a limit per action in one currency) or share data (up to a data class), the amount above which a person must approve, and an expiry of at most 90 days. A person creates it at Agent authority in the workspace and receives a token for the agent, shown once and accepted only with a proof signed by the agent's key, and a receipt Trooth signs. When the agent is about to act it asks Trooth to authorize that one action; Trooth checks it against the delegation and either answers with an evidence reference it signs, valid for ten minutes and redeemable once, or holds it for a person to approve or deny. A partner checks the reference against the keys at api.trooth.co/public/keys, reads its public state and redeems it once. The public witness log holds only a signed commitment to each receipt and reference, a SHA-256 digest, never the object. Four new webhook events carry these steps: delegation.created, delegation.revoked, action.approval_requested and action.decided. The trooth command-line tool, version 0.22.0, adds trooth evidence verify and trooth delegation verify, each with --log. Trooth's Model Context Protocol (MCP) server, version 1.7.0, now says that Trooth signs witness statements for its readings and, for workspaces that create a delegation, delegation receipts and action evidence references; it does not sign the profile or a company's declarations. Trooth records and signs what was authorized, by whom and under which limits; it does not move money, does not decide whether a payment should be made, and is not a party to the transaction.
Why it changed
A partner that receives a payment or a data request from an agent needs to know that a person at the company allowed it, within which limits, and that the request is the one that was allowed. Until now there was no record of that which the partner could check for itself.
Who is affected
- Affected: Companies whose agents pay or share data with other companies, the partners who receive those agents' requests, developers who register webhook endpoints, and users of the trooth command-line tool, which is version 0.22.0. A workspace that creates no delegation sees nothing change.
- Availability: Every workspace, from today. Creating, revoking and approving need a person signed in to the workspace; a payment, or confidential or restricted data, needs a sign-in through the company's identity provider in the last five minutes.
- Release stage: Available.
- Areas: Company workspace, API, MCP server, CLI.
What to do
No action required. Nothing anyone builds on changed. To use it, create a delegation at Agent authority in the workspace; to receive its events, subscribe an endpoint to them on the webhooks page; to check a receipt or a reference, run trooth evidence verify or trooth delegation verify with version 0.22.0.
Versions and migration
- trooth:
0.22.0
Dates
- Announced: October 15, 2026, the day this entry was written. Entries are never backdated.
- Released: October 15, 2026.
What this does not fix
Counsel reviews the responsibility boundary before Trooth's commercial launch, and no payment partner has yet accepted a Trooth evidence reference in a live pilot. A revision of the boundary becomes version 2, and each reference names the version it was issued under.