missionsPhase 11

Out-of-Bounds Access (Mission Governance at the PS)

Missions are immutable (§1279) and the resource never evaluates mission content — only the PS has the mission description, tool list, and log (§1193). Mission-level enforcement happens at the PS's token endpoint (§781, §1283, §1748). When an agent requests a scope that is inside its resource's policy but outside the approved mission, the resource still issues a resource token; the PS is the party that detects the mismatch, and per §797 responds with `202 + requirement=interaction` asking the user for consent. If the user declines, the agent must propose a new mission with a new s256.

§ PS Token Endpoint / § Mission Log

POST https://ps.example/person200

The agent holds mission M1 and asks for a person token naming it.

The PS confirms M1 exists, is active, and belongs to this agent, and stamps mission_s256 into the token.

The PS does not evaluate scope here — it has not been told one. Scope arrives with the resource token, at the auth token endpoint.

1 / 8

speed

Step 1: POST /person {resource, mission_s256=M1} → person token

Request / response

Out-of-Bounds → Supersession Timeline

→

New Mission (M2) issued after the person declined the out-of-scope consent

Description (Markdown)

# Analyze Q2 Customer Feedback (Analytics Extension)

Read customer feedback records and detailed analytics data to produce a comprehensive report.

Blob Members

approverhttps://ps.example

agentaauth:local@agent.example

approved_at2026-04-14T17:18:22Z

expires_at2026-05-14T17:18:22Z

approved_resourceshttps://api.example

The blob is what the digest covers. approver lives here and nowhere else — no token carries it.

Mission Identifier

mission (base64url)

eyJhcHByb3ZlciI6Imh0dHBzOi8vcHMuZXhhbXBsZSIsImFnZW50IjoiYWF1dGg6bG9jYWxAYWdlbnQuZXhhbXBsZSIsImFwcHJvdmVkX2F0IjoiMjAyNi0wNC0xNFQxNzoxODoyMloiLCJleHBpcmVzX2F0IjoiMjAyNi0wNS0xNFQxNzoxODoyMloiLCJkZXNjcmlwdGlvbiI6IiMgQW5hbHl6ZSBRMiBDdXN0b21lciBGZWVkYmFjayAoQW5hbHl0aWNzIEV4dGVuc2lvbilcblxuUmVhZCBjdXN0b21lciBmZWVkYmFjayByZWNvcmRzIGFuZCBkZXRhaWxlZCBhbmFseXRpY3MgZGF0YSB0byBwcm9kdWNlIGEgY29tcHJlaGVuc2l2ZSByZXBvcnQuIiwiYXBwcm92ZWRfdG9vbHMiOlt7Im5hbWUiOiJGZWVkYmFja1JlYWRlciIsImRlc2NyaXB0aW9uIjoiUmVhZCBjdXN0b21lciBmZWVkYmFjayByZWNvcmRzIn0seyJuYW1lIjoiQW5hbHl0aWNzUmVhZGVyIiwiZGVzY3JpcHRpb24iOiJSZWFkIGRldGFpbGVkIGFuYWx5dGljcyBkYXRhIn1dLCJhcHByb3ZlZF9yZXNvdXJjZXMiOlsiaHR0cHM6Ly9hcGkuZXhhbXBsZSJdfQ

s256

8qdUpOng1eVLfligpsOA7M-i2Q2VTdcnxxDLiBT9e_o

s256 is not a blob member. It is BASE64URL(SHA-256()) of the bytes mission decodes to, returned alongside it so the agent can verify the digest covers an unambiguous byte sequence. It travels as the mission_s256 claim of person, resource and auth tokens.

Approved Tools

FeedbackReader

Read customer feedback records

AnalyticsReader

Read detailed analytics data

PS Capabilities

interactionclarification

POSThttps://ps.example/person

Host

ps.example

Content-Type?

application/json

Content-Digest

sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:

Signature-KeyAAuth?

sig=jwt;jwt="eyJhbGciOiJFZERTQSIsImtpZCI6ImFnZW50LWtleS0xIiwidHlwIjoiYWEtYWdlbnQ…

Signature-InputAAuth?

sig=("@method" "@authority" "@path" "content-type" "content-digest" "signature-k…

SignatureAAuth?

sig=:U2lnbmF0dXJlQnl0ZXNFeGFtcGxlVmFsdWVGb3JEZW1vbnN0cmF0aW9uUHVycG9zZXNPbmx5:

Body

{
  "resource": "https://api.example",
  "mission_s256": "7SGTFsuKCcpYJwGRkVBi8vOc1Ssm7NdgnVaAruK87Rg"
}

HTTP Signaturescheme=jwt

Covered Components

@method

@authority

@path

content-type

content-digest

signature-key

Signature Base

"@method": POST

"@authority": ps.example

"@path": /person

"content-type": application/json

"content-digest": sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:

"signature-key": sig=jwt;jwt="eyJhbGciOiJFZERTQSIsImtpZCI6ImFnZW50LWtleS0xIiwidHlwIjoiYWEtYWdlbnQrand0In0…"

"@signature-params": ("@method" "@authority" "@path" "content-type" "content-digest" "signature-key");created=1700000000;alg="ed25519"

Signature-Key Header

sig=jwt;jwt="eyJhbGciOiJFZERTQSIsImtpZCI6ImFnZW50LWtleS0xIiwidHlwIjoiYWEtYWdlbnQrand0In0…"

Signature-Input Header

sig=("@method" "@authority" "@path" "content-type" "content-digest" "signature-key");created=1700000000;alg="ed25519"

Person Tokenaa-person+jwt

Header

{"alg":"EdDSA",
"kid":"ps-key-1",
"typ"?Token type identifier. aa-agent+jwt = Agent Token, aa-person+jwt = Person Token, aa-resource+jwt = Resource Token, aa-auth+jwt = Auth Token:"aa-person+jwt"
}

Payload

{"iss"?Issuer — who created and signed this token:"https://ps.example",
"dwk"?Discovery Well-Known — the metadata document name for key discovery (e.g. aauth-agent.json, aauth-person.json):"aauth-person.json",
"aud"?Audience — which party should accept this token:"https://api.example",
"sub"?Subject. In an agent token, the agent identifier. In a person, resource or auth token, the person's directed identifier — opaque, unique within the issuer. Identity is the pair (iss, sub); a sub from one issuer MUST NOT be matched against a record established under another.:"8f14e45fceea167a5a36dedd4bea2543",
"cnf"?Confirmation — proof-of-possession claim binding this token to a key:{"jwk"?JSON Web Key — the public key bound to this token:
},
"mission_s256"?The mission this token was issued under: the unpadded base64url SHA-256 of the approved mission blob's bytes. It is the only way a mission reaches a resource — the AAuth-Mission header was removed in -11.:"7SGTFsuKCcpYJwGRkVBi8vOc1Ssm7NdgnVaAruK87Rg",
"jti"?JWT ID — unique identifier for this token (replay detection, audit, revocation):"pt-32d653",
"iat"?Issued At — Unix timestamp when the token was created:1776222894,
"exp"?Expiration — Unix timestamp after which the token is invalid:1776226494
}

sig: cGVyc29uVG9rZW5TaWduYXR1cmVJc3N1…