ak.schema.accountability_grant.v1

Arkret Accountability Grant

ak.schema.accountability_grant.v1 · file: schemas/accountability-grant.schema.json

Issuer-signed endorsement used to verify Actor Profile accountable_principal_ids entries. This is the payload contract for ak.identity.accountability_grant.

* $ · object

Issuer-signed endorsement used to verify Actor Profile accountable_principal_ids entries. This is the payload contract for ak.identity.accountability_grant.

* schema · const "ak.schema.accountability_grant.v1"

enum: "ak.schema.accountability_grant.v1"

* issuer_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

Canonical stable DID-derived identity core. The lowercase DID method name follows ak:did_core:, and the remaining method-adapter-defined core is opaque to generic consumers. The did:web v1 adapter uses the complete canonical method-specific-id, never a digest or truncated host. Principal-core and service-core equality is byte-for-byte equality of the complete did_core_id. Event actor and Realm membership equality instead use the complete closed ActorId, and account-scoped equality uses the complete AccountId; neither may be reduced to a principal core. A did_core_id is not a DID and cannot be resolved without a did or AuthenticatedServiceResolution.

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* subject_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* accountability_scope · oneOf[2]

Non-empty duplicate-free closed set used only for display and accountability governance; never grants authorization. A string is the singleton-set wire form. Array order has no semantic meaning. Canonical authors emit singleton sets as strings and multi-value sets in ascending raw UTF-8 byte order; receivers accept every schema-valid ordering and normalize only for typed current result-subject derivation, domain equality, and projection union.

oneOf · oneOf[0] · string (enum) · $ref #/$defs/scope

enum: "employment" "contracted_service" "agent_operator"

oneOf · oneOf[1] · array<$ref #/$defs/scope>

items · string (enum) · $ref #/$defs/scope

enum: "employment" "contracted_service" "agent_operator"

* not_before · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* grant_status · string (enum)

enum: "active" "revoked"

* proof · object · $ref ./event-envelope.schema.json#/$defs/proof

Generic detached-JWS proof shape reused by non-Event schemas (snapshot signature, snapshot witness attestations, identity receipts, handle claims, etc.). MUST NOT be used as the shape of Event Envelope `producer_proof` — Event proofs reference $defs/event_proof and bind canonical Event bytes via `event_digest`. Non-Event signed objects MUST define an object-family signing-context constant and include it in the canonical proof binding object with payload_digest; the context constant is not a wire field in this generic shape. drift detection: `payload_digest#event_proof` in forbidden-wire-fields.json is the hard-reject mirror of this rule. New non-Event signed objects MAY $ref this shape; new signed Event-shaped objects MUST instead $ref event_proof.

* kind · string (enum)

Generic detached JWS proof over a canonical non-Event payload binding object that includes an object-family context constant.

enum: "detached_jws"

* verification_method · string

DID URL of the signing key for this non-Event detached proof. Same pattern as $defs/event_proof.verification_method; semantics are decoupled from Event proof (see $defs/event_proof for the Event-only shape).

pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$

* payload_digest · $ref #/$defs/digest · $ref #/$defs/digest

Generic non-Event detached-proof hash. This $defs/proof shape is reused by non-Event schemas; Event.properties.producer_proof references $defs/event_proof and MUST use event_digest instead.

* created_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

domain · string

audience · oneOf[2]

oneOf · oneOf[0] · string

oneOf · oneOf[1] · array<string>

items · string

proof_purpose · string (enum)

Optional role discriminator for non-Event proofs. HandleClaim core, status and revocation carriers make issuer_attestation, holder_acceptance, status_attestation and revocation_authorization load-bearing. governance_authorization marks a resource-governance-key authorization (directory withdraw/takedown-appeal, discovery-directory.md 8.7.1). Generic proof consumers ignore it unless their object-family contract makes it load-bearing.

enum: "issuer_attestation" "holder_acceptance" "status_attestation" "revocation_authorization" "governance_authorization"

* jws · string

pattern: ^[A-Za-z0-9_-]+\.\.[A-Za-z0-9_-]+$

Source

registry row: spec/v1/artifacts/registry/schema-registry.json
schema document: spec/v1/artifacts/schemas/accountability-grant.schema.json