Agent authority

Agent authority lets a company give an artificial intelligence agent a bounded authority to act for it with one other company: to pay up to a limit, or to share data up to a sensitivity class. When the agent is about to act, it asks Trooth to authorize that one action. Trooth checks the request against the authority, holds it for a person when it is above the limits, and answers with a short-lived reference it signs. The agent attaches that reference to the payment network's own mandate, and the partner checks it.

It is on for every workspace. People create delegations and decide requests at Agent authority in the workspace.

What a delegation is

A delegation is the record of what one agent may do, created by a person in the workspace. It names these things.

• The agent, by the thumbprint of its proof-of-possession key (RFC 7638), with a name your team recognizes.
• The role the agent acts in, such as purchasing.
• The one counterparty, by its domain, including its subdomains.
• What the agent may ask for: a payment, a data share, or both.
• For a payment, a limit per action in one currency. For a data share, the highest data class: public, internal, confidential or restricted.
• An optional amount above which every payment waits for a person.
• An expiry, at most 90 days away.

Who creates one

Only a person signed in to the workspace. An application programming interface key, a scoped token or another delegation cannot create, revoke or approve anything.

A payment delegation, or one covering confidential or restricted data, needs a sign-in through the company's own identity provider, the one its people use for single sign-on, in the last five minutes. Any other delegation needs a sign-in from the last 15 minutes.

Creating a delegation returns a token that starts with dl_. It is shown once, Trooth keeps only its digest, and it is bound to the agent's key: Trooth accepts it only with a fresh proof signed by that key (Demonstrating Proof of Possession, RFC 9449), and refuses a replayed proof.

What an agent can ask for

One action at a time, with one counterparty: a payment of an amount in a currency, or a share of data of one class. Each request names the payment protocol and the mandate it belongs to, such as Google's Agent Payments Protocol, the Agentic Commerce Protocol, the Visa Trusted Agent Protocol or Mastercard Agent Pay.

Trooth checks that the delegation allows the action, that every address in the request is on the counterparty's domain over an encrypted connection, that the currency matches and the amount is above zero and within the limit, that the data class is within the delegated class, and that the delegation has neither expired nor been revoked. One mandate gets one authorization; asking again for the same mandate returns the same answer.

When a person must approve

A payment above the delegation's approval amount, and every confidential or restricted data share, waits for a person. The agent is told the request is pending, and Trooth emails the workspace's members a link to it.

Any member of the workspace can approve or deny it in Approvals, after a sign-in through the company's identity provider in the last five minutes. The agent cannot approve its own request, and a request is decided once.

What the agent gets

An evidence reference: a compact, machine-readable JSON Web Signature (JWS) that Trooth signs with its evidence key. It is valid for 10 minutes, carries a single-use id, and is bound to the one protocol and mandate the agent named.

It records the action and its amount or data class, the counterparty, the delegation it was issued under with that delegation's digest, who approved the delegation and, where one was needed, who approved the action, Trooth's latest signed reading of the counterparty's public record, and the version of the responsibility boundary it was issued under.

How a partner checks it

A partner checks the reference without asking Trooth anything: its signature against the public key published at api.trooth.co/public/keys, then its format, its claims and its ten-minute lifetime, and that it is bound to this protocol and this mandate. The trooth command-line tool, version 0.22.0, does all of that with trooth evidence verify. The public state endpoint says whether a reference is issued, redeemed, expired or revoked, and redeeming it takes the whole reference, not just its id.

# 1. Check the signature, the format, the claims and the ten-minute lifetime#    against the keys at https://api.trooth.co/public/keysnpx trooth@0.22.0 evidence verify reference.jws --online# 2. Ask for its public state: issued, redeemed, expired or revokedcurl https://api.trooth.co/public/action-evidence/<jti># 3. Redeem it, once, with the whole referencecurl -X POST https://api.trooth.co/public/action-evidence/<jti>/redeem \  -H 'content-type: application/json' \  -d '{"evidence":"<the whole reference>"}'

A reference is accepted once. A second redeem answers that it was already redeemed, and an expired or revoked reference cannot be redeemed at all.

Delegation receipts

Creating a delegation and revoking one each return a receipt: a JSON Web Signature Trooth signs with the same key, holding the event, when Trooth recorded it, who acted and the delegation's digest. It says what Trooth recorded, not that any action under the delegation is proper. The workspace lists every delegation with its receipts.

# A delegation receipt, offline against the published keysnpx trooth@0.22.0 delegation verify receipt.jws# The same receipt and its commitment in the public witness log, once it has a place therenpx trooth@0.22.0 delegation verify receipt.jws --log --log-index <N>

What the public log holds

Trooth's witness log is public, and a receipt or a reference names private things: the workspace, the people, the amount and the counterparty. So neither is ever written to the log. The log holds only a signed commitment to each one: its SHA-256 digest, its kind and the time, signed with the same key.

Whoever holds a receipt or a reference can check that Trooth logged that exact object: compute its SHA-256 digest, read the log entry, check the commitment's signature against the published key, and check that the two digests are equal. The --log option of trooth evidence verify and trooth delegation verify does all four.

Revoking

A person in the workspace can revoke a delegation at any time. The agent can no longer use it, every reference issued under it and not yet redeemed is revoked, and Trooth answers with the time it recorded and a signed receipt. Asking again answers the same recorded time.

Rate limits

• An agent can ask for at most 60 authorizations a minute under one delegation.
• The public evidence endpoints answer at most 120 requests a minute from one address.
• Over a limit, the answer is status 429 with a Retry-After header that says how many seconds to wait.

Events

A workspace's registered webhook endpoints can subscribe to four events, signed and delivered like every other event on that channel (see Webhooks).

When a request waits for a person, Trooth also sends a push notification and one email to each member of the workspace with a confirmed address, at most 25.

The responsibility boundary

Trooth records and signs what was authorized, by whom and under which limits.

It does not move money, hold payment credentials or sign for the customer. It does not decide whether a payment should be made, and it is not a party to the transaction. The partner's mandate and its own controls govern the payment; the reference is evidence beside them.

This is version 1 of the boundary, and every reference names the version it was issued under. Counsel reviews it before Trooth's commercial launch; a revision becomes version 2.