Skip to main content

Open Specification · v1.0

A portable format for authorization-aware agent memory

ArtifactAuth is a specification: a data format plus conformance rules plus an integration interface, not a wire protocol. It defines a harness-agnostic way to annotate an agent conversation with the authorization its content required, and to enforce those requirements when the conversation is later read by another principal.

Read the full specificationAPI reference

Why a specification, not an API

Because the value compounds when everyone speaks it

A proprietary format locks authorization semantics to one vendor's harness. An open specification lets those semantics travel: the same labels and the same soundness rules, honored by whoever handles the conversation next, each side resolving them against its own policy engine. That portability is the whole point, and it only pays off once more than one party conforms.

A concrete future: consulting firm A works with clients B, C, and D

Firm A’s agents build up hard-won context inside each engagement. Today that context is trapped in silos, and the moment it moves between clients, A is one paraphrase away from leaking B’s material into D’s workspace.

If B, C, and D all conform to ArtifactAuth, A’s agent memory carries its labels across every engagement. B’s policy engine gates B’s content, C’s gates C’s, D’s gates D’s, with each tenant enforcing its own authorization against its own PDP, on the same shared format. Firm A gets its job done across all three without ever laundering one client’s context into another’s.

That’s multi-tenant, multi-PDP federation, the L3 conformance level below. It’s forward-looking and out of scope for v1.0, but it is the reason ArtifactAuth is an open specification rather than one company’s API: a shared format is what makes the cross-company case possible at all.

Vocabulary

Core concepts

Principal

A user, or an agent acting on behalf of a user, identified by an opaque id.

Capability

An abstract authorization predicate (a group, role or clearance) referenced by an opaque URN like cap://acme/finance-read.

Requirement

A small boolean expression over capabilities (true, false, cap, all, any, not) describing what a principal must satisfy to read something.

Label

The Requirement attached to a conversation segment: what it takes to read it.

Access Receipt

The record minted each time an agent accesses an artifact, capturing the requirement its source system reported (fail-closed to deny-all).

Segment

An addressable unit of a conversation: a user turn, tool call, tool result or assistant message. The unit of labeling and admission.

Policy Decision Point (PDP)

Your pluggable component that answers 'does this principal satisfy this requirement, right now?', returning permit, deny, or unknown. Queried live per read (pull), or answered locally from a grant snapshot you push.

Soundness Invariant

The one mandated rule: a segment's label must be at least as restrictive as the join of everything that influenced it. Redaction is always consistent.

Only two operations

join to combine. evaluate to enforce.

Labels form a lattice. Combining two labels is a conjunction: join(A,B) = all[A,B]. Enforcing one is a single question to your policy engine: evaluate(principal, requirement). Deliberately just those two, so any authorization backend can implement it without understanding your capability semantics.

Conformance

Three levels

L1

Annotate

Read and write the envelope: label segments with the authorization of the content they accessed, and propagate labels soundly.

L2

Enforce

Add admission control at read time via the PDP, so unauthorized content never enters a model context destined for that recipient. The reference harnesses ship at L2.

L3

Federate

Forward-looking: carry and evaluate authorization across organizational boundaries. Out of scope for v1.0.

Status

Scope & maturity

Implement or adopt the spec

Any agent framework conforms by reading and writing the envelope and implementing the Policy Decision Point interface. Reference ports exist for the Vercel AI SDK, Koog, and Google ADK.

View on GitHub