LEARN · EXECUTION BOUNDARY
Authority must survive the moment of action.
Execution-time authority means checking the current, exact permission before a protected tool submits a consequential action—not relying on an earlier plan or a tool’s availability.
VAGP 0.3
Resolve the mandate.
Verify the permit.
Record only what was observed.
WHY CHECK AGAIN
A plan can outlive its authority.
Between a model decision and a provider call, a mandate may be revoked, the agent’s attested state may change, or required status evidence may become stale. A valid identity and an available tool still cannot substitute for current authority. VAGP 0.3 specifies this boundary; a Verimand Authority Gateway enforces it in the controlled validation profiles.
THE VERIFICATION CHAIN
Eight steps, one bounded action.
The sequence below describes the VAGP 0.3 controlled execution path. Each input has a distinct role; none can be inferred from an agent’s own claim alone.
Before the protected call
Trusted identity and Agent DNA identify the subject and its attested security-relevant state. A valid mandate supplies scope. Resolution chooses one complete qualifying path; a single-use Execution Permit carries the exact authorized request to the enforcement boundary. Verification checks current state and consumes replay protection before submission.
After the call
Signed INTENT evidence is persisted before provider I/O. Signed OUTCOME evidence records the observed result after it. If the provider outcome is unknown, Evidence Certainty must say so; reconciliation cannot silently repeat the action.
SECURITY PROPERTIES
The boundaries are narrower than a generic approval.
The action, resource, constraints, validity and attested Agent DNA state must fit one complete authority path.
Revoked, suspended, unavailable or stale required authority state cannot be treated as a valid past approval.
A controlled provider mutation consumes an authentic permit bound to the exact request; replay is denied.
A timeout or missing outcome record must remain uncertain. A provider call is not retried just to fill an evidence gap.
EXAMPLE AND LIMITS
Sandbox restart: one permit, one execution.
In the reference pilot, a mandate permits a bounded sandbox workload restart. The Gateway verifies the exact permit and dispatches once. A configuration change outside that mandate is denied before downstream execution; a replay is blocked.
This is validation evidence for a controlled profile, not a production deployment or a promise of instantaneous global revocation. VAGP defines status freshness limits and does not invent distributed consistency or atomicity with every provider.
Inspect enforcement evidence and limitsPRIMARY SOURCES
Read the rule and the evidence separately.
The public VAGP specification defines the protocol semantics. The validation hub reports which Verimand implementations and test settings exercised them.