Request-time authorization decides whether an action is allowed when the request arrives, rather than relying on access established beforehand. This suits agentic systems whose requesters may be temporary, unfamiliar, or acting across domains. The decision uses portable evidence about the initiating principal and the authority connecting that principal to the requesting agent. section 18.7
A practical design separates evidence handling from the authorization judgment:
- Assemble and normalize signals such as delegation, constraints, payment details, time, and receipts. section 18.7
- Evaluate the principal, action, resource, and assembled context with deterministic policy so the result remains testable and explainable. section 18.7
- Record outcomes across collaborating domains to support audit and future decisions. section 18.7
Bounded reimbursement payment
A request can be permitted when a delegation capability matches the payment action, the amount and currency stay within delegated limits, a receipt is present, and the delegation has not expired. A signed credential can carry the agent identity, purpose, contractor, expense categories, and constraints.
