Permission,
resolved.

Auths Proof turns a chain of delegated authority into one deterministic result: an exact action that is authorized—or a precise reason it is not.

Explore the source How Auths works

Resolved authorizationAuthorized

action: deploy sha256:a91e…
audience: release-service / prod
authority: root → team → release-agent
constraints: canary · before 14:32 UTC

Canonical CBOROffline verificationFail closedBounded work

01The boundary

The verifier gets facts.
Not policy theater.

A verifier receives the proof, the proposed action, and explicit trusted context. It validates signatures, walks delegation, intersects constraints, and returns a sealed result without discovering identity or calling a control plane.

02From authority to execution

01 / Receive

Take explicit inputs

Proof bytes, action bytes, time, trusted roots, and verification limits enter together.

02 / Resolve

Walk authority

Each delegation must be valid, in scope, unexpired, and no broader than its parent.

03 / Bind

Seal the action

The action digest, audience, and effective constraints become one verified result.

04 / Return

Explain the decision

Consumers receive stable success data or a structured, deterministic failure.

03What you can rely on

Identity-agnostic

Bring any principal system that can establish control of a signing key. Authority remains a separate concern.

Protocol-defined

Canonical encoding and verification semantics belong to the public contract, not one hosted service.

Adversarially bounded

Depth, bytes, objects, and cryptographic work are limited before untrusted input is accepted.

Conformance-ready

Golden vectors, negative fixtures, and fuzz targets keep implementations in exact agreement.

04At the enforcement point

Verify. Decode. Execute.

The verified action—not ambient credentials or unchecked request data—becomes the command.

auths-proof / verifypseudocode

// No network. No hidden state.
result = proof.verify(
  envelope,
  proposed_action,
  trusted_context
)

if result.authorized:
  execute(result.verified_action)

Auths Proof

Make authorization inspectable.

See how explicit trust, bounded delegation, and exact actions form one portable authorization model.

Follow the authority path

Permission,resolved.

The verifier gets facts.Not policy theater.