[BAP] Bounded Authority · the Elixir reference
bounded_authority_report_adapter is the holder/issuer
companion signer the TypeScript package ports: it takes a {module, term()} key handle whose callbacks reach
your own custody — an HSM, a KMS, an in-process test key — and produces the signed envelope.
The private key never enters the library. The dependency is one-directional:
this adapter depends on the protocol package, never the reverse; verifiers depend only on the
protocol package, never on this adapter.
Three protocols, one chain of evidence: what the agent is, what was agreed, what this call may do.
Five entry points, one shared signing tail, one closed error-atom set — identical in shape to the TypeScript port.
| Function | Object | Role |
|---|---|---|
sign_report/3 | holder proof — the grant passes through untouched | holder |
sign_local_loopback_report/3 | local-loopback application proof (ba+loopback-proof) | holder |
sign_anchor/3 | boundary anchor | role-agnostic |
sign_key_transition/3 | key transition | role-agnostic |
sign_grant/3 | capability grant | issuer-only, structurally gated |
The properties the whole family inherits — enforced here first, ported verbatim.
A signing library that touches key material becomes the most valuable target in your system.
The adapter only ever calls {module, term()} callbacks into your custody — and every sign path ends in a verify-against-the-public-key guard, so a misconfigured custodian fails loudly.
If the agent’s key can self-issue grants, the boundary is decorative.
sign_grant/3 resolves the issuer role atomically and fails closed before sign/2 is ever called — a holder handle cannot mint its own authority.
Error messages that narrate which check failed are reconnaissance gifts.
Closed error atoms, value-free telemetry — no key material, message bytes, or report content ever appears in an error or an event.
One protocol, four repositories, two ecosystems — same wire bytes everywhere.
The monorepo: wire specs, the ADR library, certified conformance corpora, the threat model.
The npm port of this adapter — with the live envelope playground in your browser.
The npm verify side with its live bench — decode, check, tamper.
The Elixir reference signer. Docs, guides, recipes, and the upgrade path live on hexdocs.