# Autonomous Trust Resolution Protocol — Draft v0.2

**Publisher:** AgentProof  
**Status:** Public draft  
**Supersedes:** v0.1 for requests using recursive delegation  
**Compatibility:** v0.1 remains published and valid.

## New in v0.2 — Recursive Authority Chains

v0.2 adds an `authority_chain` that proves how transaction authority flows from the original principal through one or more delegated agents to the terminal agent attempting the action.

The invariant is:

> A delegation may narrow inherited authority. It may never widen it.

## Chain form

```
principal
  -> delegation[0] -> agent A
  -> delegation[1] -> agent B
  -> delegation[2] -> terminal agent
  -> transaction mandate
  -> proposed action
```

Every delegation identifies:
- delegator;
- delegatee;
- scope;
- optional validity window;
- optional amount, currency, counterparty, evidence, attestation, recourse and human-approval constraints;
- optional credential and attestation references.

## Continuity rules

1. The first delegator MUST equal `principal.id`.
2. Every later delegator MUST equal the previous link's delegatee.
3. The final delegatee MUST equal `agent.id`.
4. A discontinuity produces `DENY`.

## Non-expansion rules

A child delegation or final transaction mandate MUST NOT:
- add action scope absent from its parent;
- raise a parent maximum amount;
- extend a parent expiration;
- begin earlier than a parent validity window;
- add counterparties outside an inherited allow-list;
- change an inherited currency;
- lower inherited minimum evidence or attestation requirements;
- raise an inherited recourse threshold;
- raise an inherited human-approval threshold.

Omitted child constraints inherit the effective parent constraint.

Any explicit attempt to widen inherited authority produces `DENY`.

## Effective mandate

The resolver intersects and narrows the complete chain into an `effective_mandate`. Transaction policy evaluation is performed against that effective mandate, not merely the terminal agent's requested mandate.

## Cryptographic chain fingerprint

Each delegation receives a canonical SHA-256 fingerprint. The complete chain receives an `authority_chain_sha256`. These digests make the evaluated delegation bytes tamper-evident.

v0.2 structural validation does not by itself prove that a claimed delegator cryptographically signed a delegation. Credential/signature verification is an extension point. Implementations MUST distinguish structural chain validity from independently verified identity/signature validity.

## Authority Envelope™ registry and revocation

A delegation MAY carry an `authority_ref` containing a registry identifier and the SHA-256 digest of the exact delegation bytes.

AgentProof's reference registry issues **Authority Envelope™** records with:

- a stable authority identifier;
- the canonical delegation SHA-256;
- live `active` or `revoked` status;
- a private revocation capability held by the issuer;
- an optional privacy-controlled reveal URL.

When an `authority_ref` is present, the hosted resolver checks the registry at evaluation time.

- registered + digest match + active → registry proof is satisfied;
- registered + revoked → `DENY`;
- registered + digest mismatch → `DENY`;
- referenced but missing → `REQUIRE_MORE_PROOF` when the underlying policy would otherwise allow;
- no `authority_ref` → the link remains structurally evaluated but is labeled structural-only.

Revocation does not rewrite historical resolution or passport records. It changes the admissibility of future transactions that rely on the revoked authority.

An AgentProof registry record proves that AgentProof recorded those exact delegation bytes and their current revocation state. It does not, by itself, prove the real-world identity of the claimed delegator. External credentials or signatures can raise that assurance level.

## Version permanence

v0.1 semantics are not rewritten. A v0.1 request remains a v0.1 request. A request containing recursive `authority_chain` data is evaluated under v0.2.

## Economic model

The protocol is open. AgentProof's hosted resolver remains a machine-paid endpoint so transaction-admission volume can fund the operating trust network.