What exactly was it allowed to do?
The signed contract, with its version, and the grant bound to the parameters that were evaluated under it.
Walkthrough
One consequential action, from signed intent to a verifiable receipt.
A supplier invoice for 13,800 USD, proposed by an agent that has been delegated authority. Each step below shows the artifact it actually produces - the real shapes, not illustrations of them.
This page is a scripted walkthrough, not a live execution. It calls no 2AYE environment and moves no money. The same loop runs against the real API in the automated test suite.
- 01
A human signs the bounds
Not a role and not a scope. A signed contract states the limits: how much, to whom, through which tool, in which environment, for how long, and how far it may be delegated. Signing happens on an enrolled device, and a signed version is immutable - a material change is a new version and a new signature.
POST /v1/intents → POST /v1/intents/{id}/sign { "name": "Supplier renewals", "purpose": "Pay approved supplier invoices", "constraints": { "maximumAmount": 25000, "currency": "USD", "allowedTools": ["billing"], "allowedActions": ["renew"], "approvedCounterparties": ["vendor-4471"], "allowedEnvironments": ["production"], "delegationDepth": 1, "cumulativeLimit": 250000 } } - 02
The agent proposes an exact action
A closed envelope of typed predicates. There is no free-text field at any version, which is what keeps the counterparty's name, the account number and the invoice out of the platform entirely - it evaluates a reference, not an identity. The amount crosses as a string because it is hashed as text: 13800 and 13800.00 are the same number and different strings.
POST /v1/runtime/evaluations { "intentId": "<signed-contract>", "agentId": "<agent>", "tool": "billing", "action": "renew", "environment": "production", "predicates": [ { "type": "amount", "currency": "USD", "value": "13800.00" }, { "type": "counterparty_reference", "value": "vendor-4471" } ] } - 03
One deterministic decision
One evaluation path, and every finding reported rather than the first - an evaluator that stops at the first problem teaches an agent to iterate against the policy instead of reconsidering the action. No model output can turn a denial into an allow; semantic review may only escalate. Any error in this plane denies.
Decision { "decision": "REQUIRE_APPROVAL", "findings": [ { "code": "amount_exceeds_unattended_limit", "detail": "13800.00 USD is above the 5000.00 unattended ceiling" } ], "approvalId": "<approval>" } - 04
A person approves what they can see
The platform builds the display, not the requester. The rows come from the envelope that was evaluated and the organization comes from a registry entry that proved its domain - so nothing can put another company's name on the screen, and nothing can show a sentence that differs from what is being authorized. The device signs a statement covering both the action hash and a digest of exactly those rows.
Shown on the enrolled device Acme BankVerifiedacme.test
- Action
- Renew
- Requested by
- Procurement Agent
- Amount
- 13800.00 USD
- Counterparty
- vendor-4471
- Environment
- Production
- Expires
- 2026-09-24 10:46:00 UTC
DenyApprove 13,800.00Biometric confirmation required
- 05
A grant bound to those parameters
Single-use, short-lived, ES256-signed, and bound to a hash of the exact parameters that were evaluated. It does not say the agent may pay suppliers. It says this amount, to this counterparty, once, before this instant.
Authorization grant { "id": "<grant>", "agentId": "<agent>", "intentVersion": 1, "actionHash": "9F2C…", "expiresAt": "+60s", "singleUse": true, "signature": "<ES256>", "signingKeyId": "<kid>" } - 06
The resource verifies, then executes
The protected resource checks the grant itself rather than trusting that the agent honoured the decision. Redemption recomputes the parameter hash and compares in constant time, and the swap is atomic so two concurrent redemptions cannot both win.
Refusals the runtime actually returns replayThe grant was already spent.
wrong_agentIt belongs to a different agent.
expiredSixty seconds elapsed.
revokedAuthority was withdrawn after issue.
parameter_mismatchA material parameter changed.
contract_not_activeThe contract was paused or revoked.
- 07
A receipt, compared and chained
What ran, against what was authorized. A connector that describes nothing is recorded as "not provided" rather than as a match - describing nothing has not established that nothing changed. The decision, the approval, the grant, the redemption and the receipt all append to one hash-linked chain.
Execution receipt { "status": "Succeeded", "externalReference": "bank-txn-881", "comparison": "Matched", "intentVersion": 1, "decisionId": "<decision>", "evidenceHash": "4B17…" }
What this includes
- The same loop runs against the real API in automated tests
What this proves
Three questions that usually have no answer.
Who decided, and did they see it?
A device signature covering both the action hash and a digest of the rows the approver was shown.
Did what happened match?
A receipt comparing the executed action with the authorized one, on a hash-linked chain that can be exported and verified elsewhere.