Authority Court Protocol
The deterministic evaluation protocol that stands between intent and execution. Every tool call that produces effects must pass through the Authority Court. The pipeline is ordered, fail-closed, and cryptographically signed.
Six stages. Deterministic. Fail-closed.
Verify ToolManifest.v1 fingerprint matches the last-known baseline. If the tool has changed since the last policy evaluation, DENY with SCHEMA_DRIFT reason code.
Validate the request against the principal's budget, rate, scope, and rights ceilings. Every ceiling dimension is checked independently; any breach → DENY.
Mandatory minimum set of counterfactuals: 'What if we don't execute?' 'What is the worst-case blast radius?' 'What is the recovery cost if this fails?' All must be checked.
Tool-specific validators run against the tool call draft. Invariants include: parameter range checks, idempotency key validation, schema pin verification, and custom constraints.
For effects with risk class ≥ E2, run a dry-run simulation. Returns an EffectEstimate (cost, blast radius, duration, side effects, confidence). Simulation is always read-only.
Produce AuthorizationDecision (ALLOW/DENY/REQUIRE_APPROVAL/REQUIRE_EVIDENCE/DEFER) + CommitToken (if ALLOW) + signed DecisionRecord. Token is single-use, bound to draft hash.
Single-use execution authorization
Bound to
- Draft hash (SHA-256 of tool call + parameters)
- Ceilings snapshot (budget, rate, scope at decision time)
- Policy epoch (version of active policy set)
- TTL (maximum validity duration)
- Idempotency key (prevents replay)
Eliminates
- Replay attacks (single-use consumption)
- Authorization drift (bound to epoch)
- TOCTOU races (bound to draft hash)
- Stale approvals (TTL expiration)
- Double execution (idempotency key)
The legal artifact
Every Authority Court evaluation produces a DecisionRecord.v1 — a signed, canonical, self-verifiable artifact. It contains the policy epoch, complete intent, all declared effects, counterfactuals checked, invariants passed, ceilings snapshot, context capsule digests, the decision itself, commit token hash, and two signatures (evaluator + authority). The content hash excludes signatures and the hash field itself, enabling independent replay verification.