[BAP] Bounded Authority Protocol
Bounded Authority is an open wire protocol for per-request capability: an issuer signs a grant naming one operation, one target, one window; the holder’s key signs a proof binding that grant to one specific request; the resource verifies the envelope and keeps the cryptographic facts. Transport authentication — OAuth, mTLS, whatever you run — stays exactly where it is. This is the layer it leaves out.
The protocol is designed so that authority is bounded before it is exercised — not audited after.
A bearer token’s power is decided by whatever checked it, at whatever moment — and lives until it expires.
A grant is a signed, byte-frozen object: one operation, one target, one time window — the resource never guesses scope.
Replay and confusion attacks ride the gap between “authenticated session” and “this exact call.”
The proof commits to a digest of this request — method, target, invocation, arguments — under the holder’s key. Replay it elsewhere and it dies.
Authorization that phones home (introspection, policy services) adds a trusted party and a failure mode to every call.
The verifier checks signatures and bindings offline — deterministic, pure, closed results. No oracle, no partial acceptance.
Three protocols, one chain of evidence: what the agent is, what was agreed, what this call may do.
One spec, four repositories. The TypeScript packages are on npm; the Elixir packages on hex.pm; every site runs the real code in your browser.
The wire specs, the ADR library (thirty-plus recorded decisions), the certified conformance corpora, and the threat model. Everything else implements this.
The holder/issuer companion that produces signed grants, proofs, anchors, and key transitions through a caller-owned key handle — the private key never enters the library.
The deterministic verify side: checkEnvelope, decode, and the historical surfaces — closed results, pure verify path, conformance-proven against the certified corpora.
The reference holder-side implementation the TypeScript signer ports — plus the Elixir verifier package this monorepo ships. Same wire bytes, both ecosystems.
Every load-bearing choice in the protocol has an ADR — from the public verifier boundary and the normative parsing profile to the tri-platform build bar and dependency-currency discipline.