RFC 9396 authorization-detail type

https://bot0.ai/poa/authority

One bounded authority for one act of work inside an Agentic Power-of-Action Grant. An authorization_details item of this type says: for this act, what effect it produces and what kind of result binds; whom it may face; which discovered systems it may go through; which members of the work system may exercise it; what it may rely on and how fresh; its money limits; whether it needs a go-ahead; and when its result becomes official. Authority binds to effects within work, never to tools.

authority.schema.json grant.schema.json the specification

Shape

{
  "type": "https://bot0.ai/poa/authority",
  "act": "amazon.place_order",            // catalogue act (shop.buy) or discovered provider.operation
  "effect": "purchase",                   // fine effect — the verifier's key
  "kind": "purchased",                    // kind of result that binds; "none" never binds
  "targets": [{ "type": "merchant", "scope": "named", "ids": ["amazon", "costco"] }],
  "resources": [{ "provider": "amazon", "label": "Amazon", "category": "COMMERCE", "account": "ada@example.com", "effects": ["search", "prepare", "purchase"],
                  "locations": ["Household orders"] }],   // optional: place · reach · via · locations (10-01)
  "actors": ["urn:bot0:agent:a_456:member:buyer"],
  "grounding": { "allowed_sources": ["preferences", "accounts"], "prohibited_sources": ["inbox", "…"], "freshness": "PT0S" },
  "limits": { "currency": "USD", "transaction_amount_lte": 50, "monthly_total_lte": 300, "categories_in": ["household"] },
  "go_ahead": "standing",                 // standing · each_time · none
  "commit": "automatic"                   // automatic · user_approval · prohibited
}

This is the item as it travels in a token's authorization_details. In the Grant document the same authority is stored without type, names its act act_id, and also carries label (its plain name) and narrowed (which defaults it narrows) — that stored form is what authority.schema.json describes.

Rules a consumer of this type MUST apply

Judge the proposed effect and arguments, never only the tool name. A purchase with subscription: true is the subscription act.
A denial for the act or effect (the Grant's denied) beats this item.
When actors is non-empty, the acting agent MUST be one of them.
When resources is non-empty, the system the act goes through MUST be one of them; an empty list under a connected inventory means the act is not exercisable. A resource MAY also carry account (the identity it acts as — a different account is refused), place / reach / via (where changes land, how far it reaches, what it goes through) and locations (folders, channels or projects inside it — outside them is refused, unstated asks).
Counterparties: named lists are exhaustive; known needs the host's knowledge and otherwise asks; any is open.
Evidence MUST be a subset of allowed_sources. Accessible data is not authorized grounding.
Limits are questions for the principal, not refusals: a breach yields ASK_USER.
commit is already capped by the Grant's kind ceiling: automatic → ALLOW, user_approval → ASK_USER, prohibited → DENY.

Version 1.3 · 2026-09-29 · revised 2026-10-10 · defined by bot0.ai · no IANA registration is sought at this version.