[BAP] Bounded Authority Protocol
Bounded Authority is an open wire protocol for per-request capability: an issuer signs a grant naming one operation, one target, one window; the holder’s key signs a proof binding that grant to one specific request; the resource verifies the envelope and keeps the cryptographic facts. Transport authentication — OAuth, mTLS, whatever you run — stays exactly where it is. This is the layer it leaves out.
The protocol is designed so that authority is bounded before it is exercised — not audited after.
A bearer token’s power is decided by whatever checked it, at whatever moment — and lives until it expires.
A grant is a signed, byte-frozen object: one operation, one target, one time window — the resource never guesses scope.
Replay and confusion attacks ride the gap between “authenticated session” and “this exact call.”
The proof commits to a digest of this request — method, target, invocation, arguments — under the holder’s key. Replay it elsewhere and it dies.
Authorization that phones home (introspection, policy services) adds a trusted party and a failure mode to every call.
The verifier checks signatures and bindings offline — deterministic, pure, closed results. No oracle, no partial acceptance.
Three protocols, one chain of evidence: what the agent is, what was agreed, what this call may do.
One spec, four repositories. The TypeScript packages are on npm; the Elixir packages on hex.pm; every site runs the real code in your browser.
The wire specs, the protocol reference, the certified conformance corpora, and the threat model. Everything else implements this.
The holder/issuer companion that produces signed grants, proofs, anchors, and key transitions through a caller-owned key handle — the private key never enters the library.
The deterministic verify side for all three contract-majors plus the role-attestation and content-assertion profiles: checkEnvelope, decode, and the historical surfaces — closed results, pure verify path, conformance-proven against the certified corpora.
The reference holder-side implementation the TypeScript signer ports, alongside the Elixir verifier package this repository publishes. Same wire bytes, both ecosystems.
The protocol charter, threat model, and SDK notes describe the verification boundary and implementation responsibilities.