Authorization, proven

Prove
permission.

Auths binds authority to the action itself. Verify it locally. Execute only what was proven.

Explore Auths Proof Read the protocol
  • Offline verification
  • Exact actions
  • Principal-agnostic
Authorization proofAUTH-V1 / 8F31
Authorized
Actiondeploy a91e… to production
Actorworkload:release-agent
Authority2-of-3 approval · attenuated
Expires14:32 UTC
Network0 calls
rootgrantaction
Illustrative resolved proof
Canonical bytesDeterministic resultExplicit trustBounded work
01What Auths changes

Authentication says who.
Auths proves what.

Most systems scatter authority across tokens, policy services, configuration, and application code. Auths packages the authority chain for an exact action into a proof the receiving service can verify for itself.

01

Exact

The action, audience, constraints, and authority path are bound together.

02

Portable

The proof travels with the action and can be checked independently.

03

Local

Verification performs no network calls and depends on no authorization daemon.

02The authority model

Authority that narrows.

Start from explicit trust. Delegate bounded authority. Bind it to an exact action. Every step can preserve or reduce authority—never create more.

01 / Trust

Trusted root

Authority begins from an explicitly configured anchor.

02 / Delegate

Bounded grant

Capability, resource, audience, and time all become tighter.

03 / Execute

Exact action

The verified bytes become the only executable command.

03Reference verticals

Built for actions that matter.

The same proof model applies wherever broad credentials are too vague and a centralized decision is too fragile.

01MCP

Give agents less than a bearer token.

Authorize a tool, canonical arguments, audience, expiry, and delegation path. The MCP server verifies locally before executing the verified command.

tool
database.query
resource
analytics/orders
window
2026-07-25
mode
read-only
02Internal deployment

Approve the deployment, not a scope.

Bind the artifact digest, configuration, environment, strategy, actor, and approvers into one independently verifiable authorization.

artifact
sha256:a91e…
target
production/eu-west
strategy
canary
approval
2-of-3
04At enforcement

One operation.

No client registration dance. No ambient policy fetch. No execution from unverified request bytes.

service / authorizepseudocode
// Verify portable authority
result = auths.verify(
  proof,
  action,
  trusted_context
)

if result.authorized:
  command = profile.decode_verified(result.action)
  execute(command)
verification completenetwork: 0
05Protocol properties

Exact by construction.

The behavior belongs to the protocol contract—not a hidden service, language binding, or identity provider.

Canonical bytes

The same semantic input has one signed representation.

Deterministic results

Identical proof, action, and context produce the same result.

Bounded verification

Work, bytes, objects, and depth are explicitly limited.

Explicit trust

The verifier receives trust. It does not discover it.

Principal-agnostic

Identity establishes control. It does not define authority.

Portable conformance

Implementations agree through one protocol and corpus.

Auths Proof Protocol V1

Make permission explicit.

Explore the architecture behind portable, independently verifiable authority.

Read the architecture View the source