Authority

The Authority is the trust root of our product. It decides who every agent is, what each may do, and mints the short-lived tokens that carry those decisions. It never sits on the request path between an agent and a resource. In Zero-Trust terms it is the Policy Decision Point, meaning that every other component relies on it, defers to it, and enforces its decisions.

What it is

The Authority is the one place the system’s state of record lives. It keeps the agent registry (each registered agent’s id, checksum, granted scopes, and registration id) and the workflow registry (the multi-step plans agents run, with their per-step scopes, dependencies, and approval gates). It also holds the signing keys and publishes their public halves as a JWKS for resource servers to verify against.

What it does

When a client asks for an intent token, the Authority confirms the agent is registered, recomputes the agent’s checksum, compares it to the registered one, validates the requested scope falls inside the agent’s grant, and, if the run follows a workflow, checks the step, its prerequisites, and the delegation chain. Only if all of that holds does it mint. The token it returns carries the identity, the single intent, the key binding, and the proof claims.

API surface

The Authority’s API endpoints are organized by responsibility. An /intent endpoint is for token minting, a /grants endpoint for the scope envelopes that bound each agent, a /decisions endpoint reflecting its role as the decision point, an /oauth endpoint (including the JWKS the verifier reads), and registration endpoints for clients and workload identities. The exact request and response shapes are generated into contracts, so clients never hand-guess them.