ak.schema.agent_requested_scope_disclosure.v1

Arkret Agent Requested Scope Disclosure

ak.schema.agent_requested_scope_disclosure.v1 · file: schemas/agent-requested-scope-disclosure.schema.json

Controller-signed, verifier-bound private disclosure of an Agent's immutable requested_scope. This object is authorization evidence, not a grant. It MUST travel only over an authenticated confidential presentation/operation channel and MUST NOT be written to a public DID Document, durable Realm Event, public registry, pairing code, or notification. The verifier consumes request_id/challenge once, validates the short presentation window, verifies a current controller proof, recomputes the requested-scope commitment against the accepted-at Agent DID commitment, and then applies the Agent ceiling subset rules. After successful one-time admission, an implementation MAY retain the object only as encrypted verifier-private evidence keyed by the recomputed digest, verifier_id and audience.

* $ · object

* schema · const "ak.schema.agent_requested_scope_disclosure.v1"

enum: "ak.schema.agent_requested_scope_disclosure.v1"

* request_id · string

Identifier of the verifier's authenticated private challenge request. It is single-use at verifier_id.

pattern: ^ak:request:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* agent_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

Canonical stable DID-derived identity core. The lowercase DID method name follows ak:did_core:, and the remaining method-adapter-defined core is opaque to generic consumers. The did:web v1 adapter uses the complete canonical method-specific-id, never a digest or truncated host. Principal-core and service-core equality is byte-for-byte equality of the complete did_core_id. Event actor and Realm membership equality instead use the complete closed ActorId, and account-scoped equality uses the complete AccountId; neither may be reduced to a principal core. A did_core_id is not a DID and cannot be resolved without a did or AuthenticatedServiceResolution.

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* controller_principal_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* requested_scope · object · $ref ./event-payload.schema.json#/$defs/agent_key_scope

Agent scope object with two uses. In POST /_arkret/self/agents requested_scope it is the required immutable global Agent ceiling; in ak.agent.key.authorize it is a per-key ceiling that MAY be narrower but MUST be an actions/resources/constraints subset of the provision ceiling. It is never a capability grant. actions may contain service operation ids and content action tokens; an omitted action can never be restored by a key, Realm grant or session. resources constrain the service surface and may optionally narrow later content resources, but never authorize content by themselves. Provisioning and pairing do not materialize capability grants from this object; effective authority is the intersection of provision ceiling, key ceiling, independent Realm-scoped grants, session request, membership and policy, with participation applied as an additional deny gate.

* actions · $ref #/$defs/string_list · $ref #/$defs/string_list

Literal action ceiling. Every downstream key scope, grant or session action MUST appear here; action families, prefixes and subsumption do not widen it.

* resources · array<object>

Selector ceiling, not authorization. Each downstream selector must be covered by a parent selector. operation/service parents cover the same kind and matching explicit field and cannot carry content fields. The content-kind vocabulary is the ResourceSelector vocabulary except '*'; kind=realm covers every Realm-local content kind in the matching Realm and other content kinds cover only the same kind. Omitted parent realm_id is a cross-Realm ceiling wildcard and omitted exact ref is a same-kind/same-Realm wildcard. With no content selector, later Realm grants still choose concrete resources and no content wildcard is granted.

items · object

allOf · allOf[0] · ?

allOf · allOf[1] · ?

allOf · allOf[2] · ?

allOf · allOf[3] · ?

allOf · allOf[4] · ?

* kind · string (enum)

enum: "realm" "space" "circle" "strand" "message" "morph" "object" "relation" "view" "event" "actor" "schema" "policy" "invite" "notification" "read_cursor" "blob" "operation" "service"

realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

resource_ref · $ref #/$defs/object_ref · $ref #/$defs/object_ref

schema_ref · $ref #/$defs/non_empty_string · $ref #/$defs/non_empty_string

operation · $ref #/$defs/non_empty_string · $ref #/$defs/non_empty_string

service_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

constraints · array<$ref ./grant-constraint.schema.json>

Global mandatory constraints. Every effective key/grant/session evaluation MUST retain and AND these constraints; downstream scopes may add stricter constraints but MUST NOT omit or relax provision constraints.

items · object · $ref ./grant-constraint.schema.json

allOf · allOf[0] · ?

allOf · allOf[1] · ?

allOf · allOf[2] · ?

allOf · allOf[3] · ?

allOf · allOf[4] · ?

allOf · allOf[5] · ?

allOf · allOf[6] · ?

allOf · allOf[7] · ?

allOf · allOf[8] · ?

allOf · allOf[9] · ?

allOf · allOf[10] · ?

allOf · allOf[11] · ?

allOf · allOf[12] · ?

allOf · allOf[13] · ?

allOf · allOf[14] · ?

constraint_id · string

Optional stable identifier of this constraint within the grant; used for diagnostics and overrides.

pattern: ^(?!ak:)

* constraint_kind · string (enum)

Constraint family discriminator. v1 collapses what were 15 types into 8 by absorbing narrowly-scoped types into their conceptual parent: edit_window â†’ temporal; container_move â†’ scope_limitation; rate_limiting + resource_limit â†’ quota; approval_workflow + accountability + device_session â†’ claim_based (with constraint_subkind); encryption_requirement + visibility_control â†’ confidentiality (with constraint_subkind). Use the optional 'constraint_subkind' field to indicate the original specialization where evaluation logic differs.

enum: "temporal" "field_access" "kind_restriction" "scope_limitation" "authority_control" "quota" "claim_based" "confidentiality"

* effect · string (enum)

enum: "allow" "deny" "quarantine" "require_review"

evaluation_class · string (enum)

Cacheability/dependency hint for the authorization evaluator. stateless = pure function of (constraint, op, now); grant_local = depends on the grant object only; realm_state = depends on the exact Realm authority revision (membership, policy_version, etc.); external = depends on data outside that authority state (claim revocation status, rate-limit counts, async approval). Each constraint_kind has a canonical evaluation_class declared in constraint-schema.md Â§2.3; implementations MAY tighten (e.g. grant_local â†’ stateless) but MUST NOT loosen (e.g. external as stateless). Auth evaluators SHOULD use this hint to gate fast-path caching.

enum: "stateless" "grant_local" "realm_state" "external"

constraint_subkind · string (enum)

Optional discriminator within a constraint_kind. Standard values: claim_based.{claim,approval,accountability}; quota.{rate,resource}; confidentiality.{encryption,visibility}; temporal.{window,edit_window,redact_window,session}; authority_control.{applet_authority}. Per constraint-schema.md Â§2.2, device/session binding is NOT an independent constraint_subkind: it is the claim_based constraint_subkind=claim sub-case expressed via an accepted PCR device issuer. Implementations MAY require constraint_subkind for these families and fail closed on unknown values.

enum: "claim" "approval" "accountability" "rate" "resource" "encryption" "visibility" "window" "edit_window" "redact_window" "session" "applet_authority"

applies_to_actions · array<string>

Optional restriction of a temporal constraint to specific capability actions (e.g. ['ak.message.revise.own', 'ak.message.redact.own']). Action mismatch is neutral in the effect fold: satisfied for effect=allow and not matched for deny/quarantine/require_review.

items · string

pattern: ^ak\.[a-z0-9_]+(\.[a-z0-9_]+)*$

not_before · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

recurrence · object

Recurrence rule for temporal constraints. Used by constraint-schema.md Â§3.1.

frequency · string (enum)

enum: "daily" "weekly" "monthly" "custom"

days · array<string (enum)>

items · string (enum)

enum: "mon" "tue" "wed" "thu" "fri" "sat" "sun"

window_start · string

pattern: ^([01][0-9]|2[0-3]):[0-5][0-9](:[0-5][0-9])?$

window_end · string

pattern: ^([01][0-9]|2[0-3]):[0-5][0-9](:[0-5][0-9])?$

timezone · string

max_duration · string

ISO 8601 duration.

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

max_session_duration · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

inactivity_timeout · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

expires_after · string

ISO 8601 duration; used by approval_workflow constraint instead of expires_after_ms.

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

message_edit_window · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

message_redact_window · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

redact_after_window_allowed · boolean

condition · object

Conditional predicate for field_access and similar constraints. The `kind` value is a registered named condition from constraint-schema.md Â§4.1; unknown kinds MUST fail closed. Implementations MUST NOT introduce ad hoc string DSL predicates.

* kind · string (enum)

enum: "object_is_owned_by_actor" "actor_is_assignee" "actor_is_responsible" "actor_is_guardian" "actor_is_controller" "object_in_actor_container" "object_is_unencrypted" "object_is_encrypted" "always" "never"

allowed_write_fields · array<string>

items · string

denied_write_fields · array<string>

items · string

allowed_read_fields · array<string>

items · string

denied_read_fields · array<string>

items · string

sensitive_fields · array<string>

items · string

sensitive_handling · string (enum)

enum: "redact" "hash" "omit"

allowed_object_kinds · array<string>

items · string

denied_object_kinds · array<string>

items · string

allowed_morph_kinds · array<string>

items · string

denied_morph_kinds · array<string>

items · string

allowed_space_kinds · array<string>

Allowed Space kinds (e.g. 'board', 'list', or profile-registered kinds like 'swimlane', 'calendar_bucket'). Reducer/profile MUST validate kind value.

items · string

denied_space_kinds · array<string>

items · string

allowed_facets · array<string (enum)>

items · string (enum)

enum: "container" "replyable" "schedulable" "assignable" "stateful" "rankable" "reviewable" "notifiable" "documentable" "renderable"

denied_facets · array<string (enum)>

items · string (enum)

enum: "container" "replyable" "schedulable" "assignable" "stateful" "rankable" "reviewable" "notifiable" "documentable" "renderable"

allowed_view_ids · array<string>

items · string

pattern: ^ak:view:[A-Za-z0-9_-]{44}$

allowed_strand_ids · array<string>

items · string

pattern: ^ak:strand:[A-Za-z0-9_-]{44}$

denied_strand_ids · array<string>

items · string

pattern: ^ak:strand:[A-Za-z0-9_-]{44}$

allowed_space_ids · array<string>

items · string

pattern: ^ak:space:[A-Za-z0-9_-]{44}$

denied_space_ids · array<string>

items · string

pattern: ^ak:space:[A-Za-z0-9_-]{44}$

allowed_circle_ids · array<$ref ./common-ids.schema.json#/$defs/circle_id>

Limits Circle-scoped capability actions to the listed Circle ids. Used by ak.circle.manage / ak.circle.member.manage style grants; unconstrained Realm-wide Circle management grants are not a normal permission shape.

items · string · $ref ./common-ids.schema.json#/$defs/circle_id

pattern: ^ak:circle:[A-Za-z0-9_-]{44}$

allowed_session_ids · array<string>

Limits applet interop-session operations to the listed applet-defined session correlation ids.

items · string

pattern: ^(?!ak:)

allowed_view_kinds · array<string>

items · string

allowed_view_renderers · array<string>

items · string

denied_view_kinds · array<string>

items · string

denied_view_renderers · array<string>

items · string

allowed_relation_kinds · array<string>

items · string

allowed_from_container_refs · array<string>

items · string

pattern: ^ak:(space|strand|morph):[A-Za-z0-9_-]{44}$

allowed_to_container_refs · array<string>

items · string

pattern: ^ak:(space|strand|morph):[A-Za-z0-9_-]{44}$

wip_limit_override · boolean

example: false

allowed_tracks · array<string>

items · string

pattern: ^[a-z][a-z0-9_]{0,63}$

denied_tracks · array<string>

items · string

pattern: ^[a-z][a-z0-9_]{0,63}$

blob_presign_scope · object

Scope limiter for ak.self.blob.command.presign.v1 grants: allowed purposes plus optional blob/realm restrictions.

* allowed_purposes · array<string (enum)>

items · string (enum)

enum: "media_inline" "thumbnail" "download"

blob_ref_pattern · string

realm_ids · array<$ref ./common-ids.schema.json#/$defs/realm_id>

items · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

allowed_data_labels · array<string>

Data classification labels this grant may read, export, transform, or send to external endpoints.

items · string

pattern: ^[a-z][a-z0-9_]{0,63}$

allowed_endpoints · array<string>

Allowed outbound endpoint origins or deployment-approved endpoint patterns for applet / agent / connector operations.

items · string

max_authority_depth · integer

Maximum remaining authority hops. Bounded by the canonical authority-chain depth ceiling (4) defined in zh/conformance/scalability-constraints.md Â§3 and zh/authz/capabilities.md Â§10.2; reducers MUST reject grants declaring a larger value at accept time rather than only truncating during DFS.

authority_path_ids · array<$ref ./common-ids.schema.json#/$defs/did_core_id>

items · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

authority_regrant_allowed · boolean

authority_scope · string (enum)

enum: "narrowing_only" "same_scope" "custom"

applet_id · string · $ref ./common-ids.schema.json#/$defs/applet_id

Stable canonical Applet installation identity. Applet service authority is carried separately by service_id.

pattern: ^ak:applet:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

executed_by · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

registration_epoch · string

authority_control(constraint_subkind=applet_authority) binding to the canonical Applet registration epoch.

pattern: ^sha256:[0-9a-f]{64}$

blob_max_bytes · integer

blob_presign_max_ttl_seconds · integer

Maximum TTL, in seconds, that this grant permits for ak.blob.presign. The service must clamp requested max_age_seconds to the smaller of this value and deployment policy.

max_total_blob_bytes · integer

max_artifact_bytes · integer

Maximum artifact size in bytes for applet / agent / export operations.

max_operations · integer

Maximum number of distinct accepted idempotency identities in one UTC epoch-aligned fixed period. Enforcement is a linearizable check-and-reserve at one logical quota authority shared by every node in the enforcing service; per-node duplicated budgets and overshoot are forbidden.

period · string

ISO 8601 duration. For quota constraints, a stricter conditional schema permits only a non-zero fixed-length week/day/hour/minute/second duration; year/month durations are forbidden so every authority derives the same UTC epoch-aligned window id.

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

burst · integer

Optional token-bucket capacity at the same logical quota authority, capped by max_operations and refilled at max_operations/period. It never increases the fixed-window total budget.

constraint_scope · string (enum)

Closed v1 quota counting scope. Unknown values are schema violations and MUST fail closed. Quota counters are actor-bound; the enum selects the additional slicing dimension: actor only, actor+space, actor+realm, or actor across all nodes/regions of the enforcing service's global quota domain. global is not an implicit federation-wide counter. Every node in the service domain MUST share one logical linearizable quota authority.

enum: "per_actor" "per_space" "per_realm" "global"

max_resources · integer

resource_kind · string

approval_required · boolean

approval_mode · string (enum)

The only approval mode of v1. The approved write MUST NOT take effect before the approval evidence is verified and accepted in the same transaction (zh/authz/constraint-schema.md section 9.2.7). There is no second mode and no path that first materializes a proposal object and then approves that object.

enum: "before_commit"

approval_actor_ids · array<$ref ./common-ids.schema.json#/$defs/did_core_id>

items · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

approval_relation · string (enum)

Responsibility classification of this grant explicit approval_actor_ids roster. It never creates a second dynamic roster or supplies action/scope capability. Missing explicit roster cannot satisfy approval.

enum: "responsible" "controller" "guardian" "realm_admin" "custom"

timeout · string

Positive fixed ISO 8601 duration (week/day/hour/minute/second, no calendar year/month). Each approval vote is valid only when the target covering committed_at <= that vote input.approved_at + timeout, inclusive and with zero tolerance. The same rule applies to Event and operation targets; receiver clocks and first-seen timestamps never anchor it. Omission adds no grant-local age limit.

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

approval_threshold · oneOf[2]

Closed executable vote threshold: majority means floor(N/2)+1, unanimous means N, and a positive integer is the exact quorum. N is the distinct eligible approver set at the accepting authority cut. Omission means unanimous. A missing or empty eligible set, or an integer greater than N, cannot satisfy approval. Repeated signatures by one approver count once. Parameterless quorum/custom strings are schema violations.

example: "unanimous"

oneOf · oneOf[0] · string (enum)

enum: "majority" "unanimous"

oneOf · oneOf[1] · integer

accountability_required · boolean

guardian_approval_required · boolean

controller_approval_required · boolean

required_claims · array<object>

Conditional claim requirements. resource-selector-grammar.md Â§3.3 caps this array at 32 entries as a normative DoS guard; the schema enforces maxItems:32 so condition-selector grants cannot smuggle in unbounded claim objects.

items · object

anyOf · anyOf[0] · ?

anyOf · anyOf[1] · ?

* claim_kind · string

issuer_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

trusted_issuer_ids · array<$ref ./common-ids.schema.json#/$defs/did_core_id>

items · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

subject_matches_actor · boolean

If true, the credential subject did_core_id MUST match the actor did_core_id after each proof's DID is independently validated and projected through its registered method adapter.

example: true

value_constraints · object

Per-field equality / membership constraints on credential claims.

organization_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

status · string

roles · array<string>

items · string

trusted_claim_issuer_ids · array<$ref ./common-ids.schema.json#/$defs/did_core_id>

items · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

claim_refresh_required · boolean

claim_max_age · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

allowed_history_access_values · array<string (enum)>

items · string (enum)

enum: "since_join" "all_history_for_current_members"

redacted_history_allowed · boolean

encryption_required · boolean

min_encryption_level · string (enum)

confidentiality(constraint_subkind=encryption) static floor: the minimum content-encryption mechanism the grant requires. Pure static declaration evaluated as stateless unless cross-checked against the scope's current MLS activation state (see constraint-schema.md section 12).

enum: "none" "mls_rfc9420" "external"

plaintext_fallback_allowed · boolean

confidentiality(constraint_subkind=encryption) static flag: whether the grant permits plaintext in a scope that has no accepted ak.mls.genesis. After activation the flag cannot restore plaintext; the write MUST be rejected with mls_activation_irreversible. See constraint-schema.md Â§12.

audit_trail_required · boolean

confidentiality(constraint_subkind=encryption) static flag: whether the grant requires an audit trail (e.g. active Audit Applet Binding). See constraint-schema.md Â§12.

key_rotation_period · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

max_key_age · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

key_backup_required · boolean

approved_key_issuer_ids · array<$ref ./common-ids.schema.json#/$defs/did_core_id>

items · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

depends_on_moderation_state · boolean

Cache-invalidation hint: when true, this grant's authorization decisions depend on the moderation_state typed current result (see capabilities.md Â§18.1) and the grant's cache entry MUST be invalidated when that typed current result changes. Default false: ordinary grants (ak.strand.update / ak.message.create / organization membership grants) do NOT take a cache hit on every moderation decision. v1 capabilities.md Â§18.1 lists three conditions where MUST be explicitly true (moderator-role grants, condition-selector subjects referencing moderation state, constraints referencing moderation queue / typed current result). Schema-side enforcement of condition (2) is in capability-grant.schema.json via if/then on actions[]; conditions (1) and (3) are reducer-side lint. Cache invalidation hint outside the eight constraint families; it does not participate in allow/deny evaluation and is documented in capabilities.md Â§6 / constraint-schema.md.

allowed_managed_actor_roles · array<string (enum)>

Ordinary authority_control permits only these accepted roles of the Applet bound by the parent applet_authority constraint; no arbitrary third-party regrant.

items · string (enum)

enum: "bot" "ghost"

(^x_[a-z][a-z0-9_]{0,63}$) · any

* verifier_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* audience · string

Exact origin, service audience, or canonical operation audience requested by verifier_id.

* challenge · string

Verifier-generated unpredictable challenge. The (verifier_id, request_id, challenge) tuple is single-use; replay MUST fail closed.

* issued_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* proofs · array<$ref ./event-envelope.schema.json#/$defs/proof>

At least one current controller proof. The proof verification method MUST belong to controller_principal_id or one of its currently authorized devices. payload_digest is sha256(canonical_json(this object with proofs omitted)); detached JWS signs canonical_json({context:'ak.agent_requested_scope_disclosure_proof.v1', payload_digest, agent_id, controller_principal_id, verifier_id, audience, challenge, verification_method, created_at}).

items · object · $ref ./event-envelope.schema.json#/$defs/proof

Generic detached-JWS proof shape reused by non-Event schemas (snapshot signature, snapshot witness attestations, identity receipts, handle claims, etc.). MUST NOT be used as the shape of Event Envelope `producer_proof` — Event proofs reference $defs/event_proof and bind canonical Event bytes via `event_digest`. Non-Event signed objects MUST define an object-family signing-context constant and include it in the canonical proof binding object with payload_digest; the context constant is not a wire field in this generic shape. drift detection: `payload_digest#event_proof` in forbidden-wire-fields.json is the hard-reject mirror of this rule. New non-Event signed objects MAY $ref this shape; new signed Event-shaped objects MUST instead $ref event_proof.

* kind · string (enum)

Generic detached JWS proof over a canonical non-Event payload binding object that includes an object-family context constant.

enum: "detached_jws"

* verification_method · string

DID URL of the signing key for this non-Event detached proof. Same pattern as $defs/event_proof.verification_method; semantics are decoupled from Event proof (see $defs/event_proof for the Event-only shape).

pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$

* payload_digest · $ref #/$defs/digest · $ref #/$defs/digest

Generic non-Event detached-proof hash. This $defs/proof shape is reused by non-Event schemas; Event.properties.producer_proof references $defs/event_proof and MUST use event_digest instead.

* created_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

domain · string

audience · oneOf[2]

oneOf · oneOf[0] · string

oneOf · oneOf[1] · array<string>

items · string

proof_purpose · string (enum)

Optional role discriminator for non-Event proofs. HandleClaim core, status and revocation carriers make issuer_attestation, holder_acceptance, status_attestation and revocation_authorization load-bearing. governance_authorization marks a resource-governance-key authorization (directory withdraw/takedown-appeal, discovery-directory.md 8.7.1). Generic proof consumers ignore it unless their object-family contract makes it load-bearing.

enum: "issuer_attestation" "holder_acceptance" "status_attestation" "revocation_authorization" "governance_authorization"

* jws · string

pattern: ^[A-Za-z0-9_-]+\.\.[A-Za-z0-9_-]+$

Source

registry row: spec/v1/artifacts/registry/schema-registry.json
schema document: spec/v1/artifacts/schemas/agent-requested-scope-disclosure.schema.json