Agent Admission — Apply

PROPOSED — not yet upstreamed. Built to the ToIP spec.meta.schema.json for the dtgwg-trust-tasks-tf registry; the slug below is proposed to that namespace, not registry-accepted. The PR is pending; the registry's decision governs.

Proposed slug: agent-admission/apply · version 0.1 · status draft

A candidate agent opens an admission application at a gate authority, submitting a canonicalised statement of understanding whose own digest deterministically draws the criteria it will be challenged on.

Abstract

The Agent Admission — Apply Trust Task is the first step of the two-gate
admission ceremony: a candidate agent asks a gate authority to consider it for
admission under a named governing policy. Admission tests understanding, not
key possession — any agent can hold a key; the ceremony asks whether the agent
comprehends the policy it will be bound by, and (separately) whether a human
accountable for it approves (agent-admission/approve).

The application carries a canonicalised submission — the agent's statement
of understanding in its own words. The response carries the witness draw:
understanding criteria sampled deterministically from the SHA-256 of the
canonical submission bytes. Because the draw is a function of the submission
itself, the agent cannot know which criteria will be probed while it writes —
the submission cannot be written to the test, and any auditor holding the
canonical bytes can re-derive the draw.

Status of this Document

This is a draft Trust Task specification per SPEC.md §5.3; the schema MAY change without notice. Feedback via the issue tracker.

Conformance

RFC2119(https://www.rfc-editor.org/rfc/rfc2119) and RFC8174(https://www.rfc-editor.org/rfc/rfc8174) key-word conventions apply.

A conforming producer (the candidate agent) MUST:

Emit a Trust Task document whose type is https://trusttasks.org/spec/agent-admission/apply/0.1, with itself as issuer, the gate authority as recipient, and a verifiable proof.
Set payload.agent equal to the document issuer.
Compute payload.submissionDigest over the canonical submission bytes (recursive key-sort, no insignificant whitespace) and persist those bytes unchanged for the lifetime of the application, so the draw stays re-derivable.

A conforming consumer (the gate authority) MUST:

Verify the proof and reject agent ≠ issuer with agentMismatch.
Retrieve the submission (via submissionRef or a prior channel), canonicalise it, and reject a digest mismatch with submissionNotCanonical — the draw MUST NOT be derived from bytes that do not hash to submissionDigest.
Derive the witness draw deterministically from submissionDigest and the governing policy's criterion set, append the application-opened event to its content-addressed audit ledger, and return the draw in the #response.
Persist the canonical submission bytes it derived the draw from, so an auditor can re-derive it.

Payload

payload.agent (REQUIRED) — VID of the candidate agent; MUST equal issuer.
payload.policyRef (REQUIRED) — reference to the governing policy the agent claims to understand.
payload.submissionDigest (REQUIRED) — SHA-256 (lowercase hex) of the canonical submission bytes.
payload.submissionRef (OPTIONAL) — retrieval reference for the submission bytes.
payload.ext — extension slot per SPEC.md §4.5.1.

Request

{
  "id": "urn:uuid:7c1b2a90-4d5e-4f6a-8b9c-0d1e2f3a4b5c",
  "type": "https://trusttasks.org/spec/agent-admission/apply/0.1",
  "issuer": "did:key:z6MkCandidateAgentExample",
  "recipient": "did:key:z6MkGateAuthorityExample",
  "issuedAt": "2026-07-18T10:00:00Z",
  "payload": {
    "agent": "did:key:z6MkCandidateAgentExample",
    "policyRef": "https://gate.example.com/policy/deployment-rules/3.1",
    "submissionDigest": "9c1f4b7a2e6d80f35a4c9b1e7d2f60839c1f4b7a2e6d80f35a4c9b1e7d2f6083",
    "submissionRef": "https://gate.example.com/applications/inbox/7c1b2a90"
  },
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-jcs-2022",
    "created": "2026-07-18T10:00:00Z",
    "verificationMethod": "did:key:z6MkCandidateAgentExample#z6MkCandidateAgentExample",
    "proofPurpose": "assertionMethod",
    "proofValue": "z3FXQmV6ExampleProofValueForAgentAdmissionApply"
  }
}

Response

The gate authority answers with the #response document reachable via $anchor: "response": the applicationId, the derived witnessDraw, and respondBy. Failures use trust-task-error.

{
  "id": "urn:uuid:2e8d3c41-5b6f-4a7d-9c80-1f2a3b4c5d6e",
  "type": "https://trusttasks.org/spec/agent-admission/apply/0.1#response",
  "issuer": "did:key:z6MkGateAuthorityExample",
  "recipient": "did:key:z6MkCandidateAgentExample",
  "threadId": "urn:uuid:7c1b2a90-4d5e-4f6a-8b9c-0d1e2f3a4b5c",
  "issuedAt": "2026-07-18T10:00:02Z",
  "payload": {
    "applicationId": "app-7c1b2a90",
    "witnessDraw": {
      "algorithm": "sha256-canonical-json",
      "submissionDigest": "9c1f4b7a2e6d80f35a4c9b1e7d2f60839c1f4b7a2e6d80f35a4c9b1e7d2f6083",
      "criteria": [
        { "criterionId": "deployment-rules/3.1#scope-derivation", "prompt": "Explain, in your own words, how your deployment scope is derived and what holds it at zero." },
        { "criterionId": "deployment-rules/3.1#revocation", "prompt": "What must you do when your credential is revoked while a delegated task is in flight?" }
      ]
    },
    "respondBy": "2026-07-18T10:30:00Z"
  },
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-jcs-2022",
    "created": "2026-07-18T10:00:02Z",
    "verificationMethod": "did:key:z6MkGateAuthorityExample#z6MkGateAuthorityExample",
    "proofPurpose": "assertionMethod",
    "proofValue": "z58aKqExampleProofValueForAgentAdmissionApplyResponse"
  }
}

Security & Privacy

The submission is the agent's own prose and may reveal its construction; it is
shared with the gate authority only, and the witness draw exposes criterion
identifiers and prompts, not the submission. The deterministic draw is the
anti-grooming mechanism: neither party can steer which criteria are probed
without changing the submission bytes, which changes the digest, which changes
the draw — and the draw's derivation is itself an auditable artifact. Carry the
exchange over an authenticated, confidential transport; the application opens
recoverable state, so gate authorities SHOULD rate-limit and expire unanswered
applications.

Assets

Source: specs/agent-admission/apply/0.1/ — spec.md + payload.schema.json

📎 agent-admission-applypayload.schema.json spec.md

upstream: ~/dtgwg-trust-tasks-tf-mage (untracked contribution lane; upstream registry: trustoverip/dtgwg-trust-tasks-tf) · author: Mitchell Travers · the git source wins on any disagreement · (⚔️⊥⿻⊥🧙)😊

← The Trust Tasks · Welcome Visitors