# Verimand Multicloud Authority PoV v0.2 - Sanitized Evidence Appendix

- Evidence package: `multicloud-vagp-0.2-public-sanitized-preview`
- Source baseline: VAGP v0.2 frozen baseline, 2026-09-08
- Scope: public preview appendix for owner review
- Claim level: bounded experimental live PoV, not production readiness

This appendix summarizes the completed Google Cloud and Microsoft Azure VAGP
v0.2 Proofs of Value in a form suitable for public review. It records evidence
only. It does not change VAGP semantics, cloud infrastructure, IAM/RBAC,
Firebase hosting, product APIs or deployment state.

The internal source package includes raw traces and provider identifiers. This
public appendix intentionally omits raw trace IDs, tenant IDs, principal object
IDs, account numbers, secret values, credentials, raw witness payloads,
decision keys, selected path keys, mandate IDs and principal lineage.

## Evidence Boundary

The PoVs show that one frozen VAGP v0.2 authority model gated protected
operations in two cloud identity ecosystems:

- Google Cloud used Google Agent Identity and a protected Secret Manager
  version-state operation.
- Microsoft Azure used Entra Agent Identity and a protected ARM VM operation.
- Provider identity answered who the agent was in that cloud.
- VAGP answered why that authenticated agent may or may not perform one exact
  consequential action.
- IAM/RBAC remained necessary for technical execution and was not treated as
  organizational authority.

## Six-Case Matrix

| Cloud           | Case                          | Trusted identity source                                 | Authority path outcome                                    | Exact action                   | Canonical resource      | VERIFY result | Provider invocation                            | Observed state                                                                | Limitation                                                                      |
| --------------- | ----------------------------- | ------------------------------------------------------- | --------------------------------------------------------- | ------------------------------ | ----------------------- | ------------- | ---------------------------------------------- | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
| Google Cloud    | A: authorized DEV             | Google Agent Identity mapped to the CloudOps agent      | `AUTHORITY_CONFIRMED -> BOUND -> GRANT_DERIVED`           | `cloud.secret.version.disable` | `secret:development:01` | `VERIFIED`    | Invoked Secret Manager version-state operation | Development dummy version disabled; production dummy version remained enabled | Bounded live PoV. Secret values, raw traces and provider identifiers withheld.  |
| Google Cloud    | B: authenticated PROD blocked | Google Agent Identity mapped to the same CloudOps agent | `NO_AUTHORITY`                                            | `cloud.secret.version.disable` | `secret:production:01`  | `NOT_REACHED` | Not invoked                                    | Development and production dummy versions remained enabled                    | Shows authority denial before provider mutation, not IAM replacement.           |
| Google Cloud    | C: post-DERIVE revocation     | Google Agent Identity mapped to the CloudOps agent      | `AUTHORITY_CONFIRMED -> BOUND -> GRANT_DERIVED`           | `cloud.secret.version.disable` | `secret:development:01` | `REJECTED`    | Not invoked                                    | Development dummy version remained enabled after revocation                   | Revocation is checked at VERIFY within the single-instance process-local scope. |
| Microsoft Azure | A: authorized DEV             | Entra Agent Identity mapped to the CloudOps agent       | `AUTHORITY_CONFIRMED -> BOUND -> EXECUTION_GRANT_DERIVED` | `cloud.vm.stop`                | `vm:development:01`     | `VERIFIED`    | Invoked ARM VM operation                       | Development VM deallocated                                                    | Bounded live PoV. Raw object IDs, traces and tenant details withheld.           |
| Microsoft Azure | B: authenticated PROD blocked | Entra Agent Identity mapped to the same CloudOps agent  | `NO_AUTHORITY`                                            | `cloud.vm.stop`                | `vm:production:01`      | `NOT_REACHED` | Not invoked                                    | Production VM remained running during the scenario                            | Shows authority denial before ARM mutation, not production readiness.           |
| Microsoft Azure | C: post-DERIVE revocation     | Entra Agent Identity mapped to the CloudOps agent       | `AUTHORITY_CONFIRMED -> BOUND -> EXECUTION_GRANT_DERIVED` | `cloud.vm.stop`                | `vm:development:01`     | `REJECTED`    | Not invoked                                    | Development VM remained running during the scenario                           | Witness evidence explains revocation; it never authorizes execution.            |

## What The Package Supports

Allowed public claims from this appendix:

- frozen VAGP v0.2 protocol baseline;
- independently re-reviewed baseline, with zero Critical, High or Medium
  findings recorded in the local freeze record;
- bounded live authority PoV on Google Cloud;
- bounded live authority PoV on Microsoft Azure;
- real cloud identity was used in each PoV;
- organizational authority gated protected execution;
- `NO_AUTHORITY` blocked authenticated production-labeled requests;
- post-DERIVE revocation caused VERIFY rejection before provider invocation.

Claims not supported by this appendix:

- production readiness;
- formal verification;
- impossible-to-bypass security;
- horizontally scalable authority;
- distributed authority state;
- durable replay protection across restarts;
- portable signed grants;
- cryptographic witness authenticity;
- signed Authority Receipts;
- IAM replacement;
- policy replacement;
- vendor endorsement by Google Cloud or Microsoft Azure.

## Witness Boundary

Authority Witness evidence explains why authority existed or why it failed. A
Witness is not a grant, credential, bearer capability, cryptographic receipt or
permission to execute. In these PoVs, minimized external witness projection was
used to avoid exposing raw verifier evidence, decision keys, selected path keys,
mandate IDs, principal lineage or secrets.

Provider execution remains separate evidence. A positive VERIFY result can
precede protected execution, but does not itself prove that the external
provider mutation succeeded.

## Runtime Limitations

The v0.2 PoV state is single-instance and process-local. It does not claim:

- durable restart continuity;
- multi-replica or multi-region coordination;
- distributed authority state;
- atomicity between VERIFY and provider mutation;
- durable or tamper-evident witness retention;
- portable or signed execution grants;
- cryptographic mandate authenticity;
- cryptographic witness authenticity;
- a public Authority API.

Publication of this appendix should wait for owner review of the selected
public artifacts and any desired redaction policy.