Date: Tue, 01 Sep 2026 09:46:31 +0000
To: "oauth@ietf.org" <oauth@ietf.org>
From: Blake Morrison <blake@truealter.com>
Message-ID: 
 <s0Ms3F0hPivCpkxYiM04nKUvgQfJwNx9W2Nxd5EdKfa-swa_xEl54eBHGUTS7s6p2pH5pyvkoNL-GSzvvTUk1vgd79MLUIgwl_otvYyz2XI=@truealter.com>
In-Reply-To: 
 <DS0PR10MB7405437A5BA1CAD3ECBD43C4DBAE2@DS0PR10MB7405.namprd10.prod.outlook.com>
References: <9241DDB3-78D5-44F1-AF5B-992113226235@yuthent.com>
 <kiD5GqNkywLXWyhXTw76cpJ3fS1zaynfR4-_RaUmdloFLNBrdp6Y6rSX505QoDdJVfv67h-BueZvk-0OIGI7m57OAkpqJxZR2oLsUBbBrnA=@truealter.com>
 <sBsWoXHgtt17647k3LIUiYLWAaeNwMtXhN66SQpprmJ35N6EWM6ke-4cZxwnFcFwE_fykYtJDXEKxQhAH-Pn1_dvjJhwO-o0KvjaXgXafsY=@proton.me>
 <ITxGtpvZDzAVvODaTmowUGYjuEVMlaMVOX6CEfLxQtLZwtkN_OXCf_vVj9XpgMnlqGRlYyr6PB1J_MQ-WfHG0F_ChIESh1NX4j6Xm5FzkSk=@truealter.com>
 <DS0PR10MB7405437A5BA1CAD3ECBD43C4DBAE2@DS0PR10MB7405.namprd10.prod.outlook.com>
Feedback-ID: 187617253:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Message-ID-Hash: WKPHMEPTIWWQRU4BROJDPCQCSDIPTGK3
CC: Brian Vicente <bvicente=40sanctumsecops.com@dmarc.ietf.org>,
 "drew@truealter.com" <drew@truealter.com>
Precedence: list
Subject: =?utf-8?q?=5BOAUTH-WG=5D_Re=3A_New_I-D=3A_Problem_statement_on_verifiable_hu?=
	=?utf-8?q?man_mandates_for_autonomous_agent_actions?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/oauth/_BSXgtrrIisjJ3aHOs0YtFwSWPk>

Brian,

Issuance, subset check, and spend does not distinguish a mandate spent by t=
he
action it authorised from one spent by being superseded. Under that resolve=
r
both are the same event and the auditor sees a spent mandate either way.

That distinction is why amend is in the response space at all. It is the
outcome that carries the agent's own error. A refusal says the answer is no=
.
An amendment says the question stood and the answer space the agent offered
was wrong. Collapse the two into spend and the resolver stays small while t=
he
signal the escalating class exists to produce is gone.

It costs nothing to keep. You have already argued that reliance has to be a=
n
emitted, independently checkable event rather than a counter, and I agree w=
ith
the reason. Why a mandate was spent belongs in that same event. One structu=
re
carries both requirements, no verifier reasons about mutation, and no
amendment code path comes back.

So the smaller trusted surface holds. What it needs is for spend to say whi=
ch
of the two it was.

Best,
Blake


On Thursday, 27 August 2026 at 10:41 AM, Brian Vicente <bvicente=3D40sanctu=
msecops.com@dmarc.ietf.org> wrote:

> Blake, Morgan, Mohamad,
>=20
> On amendment as a T0-grade event: I agree with the conclusion and want to=
 state the operational consequence plainly, because it is the part an imple=
menter will get wrong.
>=20
> If an amendment is a principal-signed T0 event at the original evidence b=
ar, then there is no amended mandate. There is a second mandate and the fir=
st is spent. That means a verifier never needs to reason about mandate muta=
tion, and a resolver never needs an amendment code path. It only needs issu=
ance, subset check, and spend. That is a smaller trusted surface, and it is=
 the reason I would keep the T0 framing even though it prices amendment out=
 of the asynchronous case.
>=20
> One consequence worth writing into the problem statement: because amendme=
nt requires a present principal, the response space an escalation may offer=
 is bounded by reachability, not only by declarer independence. A statement=
 that lists accept, refuse, and amend as peers will mislead implementers in=
to building an amend path that is unreachable in exactly the deployments th=
at motivated escalation in the first place.
>=20
> On single reliance, I support Morgan's split as stated: the mandate is st=
anding authority, and reliance attaches to the evidence artifact. I want to=
 reinforce why reliance must be an auditable event rather than something a =
counter prevents. With independent verifiers, each can honestly rely once. =
A counter held by any single party cannot distinguish honest concurrent rel=
iance from replay, and a counter held by the runtime is held by the party t=
he artifact exists to avoid trusting. An emitted, independently checkable r=
eliance event is the only construction I have been able to make work across=
 verifiers that do not coordinate.
>=20
> On the lifecycle requirement, I would go one step further than "a timesta=
mp is not a mechanism." The requirement is establishing the as-of state wit=
hout trusting the party that held it. In deployed PKI terms that means the =
status assertion has to be verifiable by a relying party that trusts neithe=
r the issuer's runtime nor its operator. We run this against hardware-bound=
 signing on our own CA and it is the requirement most often quietly unmet.
>=20
> I am happy to contribute text for the amendment and reliance requirements=
 if the authors want it.
>=20
> Best,
> Brian Vicente
> Sanctum SecOps LLC