Authority derived, not issued.
When software needs to do work, do not hand it a broad bearer token. The SDK derives a capability for the exact action: operation, resources, time window, and limits. Anyone can verify the signature offline.
AI agents were the spark, but delegated action is the category. Any actor that performs work can carry bounded, verifiable authority: workers, workflows, tools, links, devices, services, and agents.
The SDK is the sovereign engine. MCP exposes it to runtimes. AgentEnvelope Web adds the hosted governance head: vaults, ledgers, billing, and audit controls.
Issued authority
Derived authority
OAuth and JWTs issue bearer tokens.
The SDK derives action authority.
API keys are shared service secrets.
Capabilities are scoped signing identities.
Revocation needs infrastructure.
Decay is embedded in the envelope.
One leaked token can be broad.
One leaked capability is isolated.
Verification often needs state.
Verification can be stateless.
Software is acting faster than ordinary credentials can safely govern.
Why now
Action moved beyond human sessions.
Workers, workflows, tools, devices, scripts, and AI agents now act without a human at the keyboard. Too often they still borrow a human API key, OAuth token, JWT, or shared secret.
Old Web2 model
Every borrowed credential is impersonation.
The system can see that a credential was used. It cannot prove which actor used it, under whose authority, for what scope, or within what limit. That is the authority gap for autonomous and automated systems.
AgentEnvelope model
Authority is carried by the action.
Each action carries a scoped capability derived from a root. The verifier checks the signature, operation, resources, time window, and limits before execution. Authority becomes a provable property of the action itself.
Security result
One capability, one bounded blast radius.
A leaked capability is isolated to its envelope. It does not expose the parent root, sibling capabilities, or every resource the original account could reach. Verification can run offline with no call home and no hosted API in the loop.
The proof object is the product.
This browser verifies a public demo action with the SDK: a support operation scoped to one refund, one order, one time window, and one use. The runtime can plan anything it wants; the action still has to prove bounded authority before execution.
Verified locally
A bounded refund action proves before it runs.
Action identity
0xe655a64781f7ff27f6f247030baefd4b2e120fa8
Operation
issue-refund
Scope
order:ord-7781/refund:max-75-gbp
Domain
customer-support/support-ops
Window
2026-08-15 to 2026-08-15, max 1 uses
Envelope hash
Match0x46e741efdcbd41c5ff...1818b6d2a9106
Payload hash
Match0x05bfb76309b9fa3a4c...362cb42e62fbb
Signature recovered
0x71c8c97792b94b6c5db0ec9...8d8b7ed89410bd1b
recovered: 0xe655a64781f...2e120fa8
Two ways to run the same authority model.
Run the SDK with your own root, or govern the same model through AgentEnvelope Web. Both paths use the same derived capability and signed action model.
Sovereign SDK
Hold your own root. Sign and verify offline. No account, no API key, and no AgentEnvelope server in the trust path.
Governance head
Use AgentEnvelope Web when you need hosted minting, vaults, ledgers, audit exports, billing, API-keyed routes, and team continuity around the same authority model.
AI agents are one case. Delegated action is the category.
The first market spark is AI agents, but the primitive is not limited to AI. Any actor that performs a task can carry its own bounded, verifiable authority.
AI agents
LLM agents, multi-agent frameworks, tool runners, planning agents, browser automation.
Backend workers
Node, Python, Go, Rust, Lambda, Cloudflare Workers, Vercel Edge Functions.
Workflow engines
Temporal, Step Functions, Airflow, Prefect, n8n, GitHub Actions, CI/CD pipelines.
Orders and instructions
Purchase orders, work orders, approvals, dispatch instructions, and delegated task envelopes.
Permissions and access
Temporary hotel keys, facility access, device unlocks, scoped API permissions, and operator approvals.
Devices and fleets
IoT sensors, industrial robots, warehouse robots, drone swarms, smart home devices.
Example: ProjectEnvelope
ProjectEnvelope uses the SDK without AgentEnvelope Web. It holds its own root, derives scoped link authority, and builds its own governed link system on the same cryptographic primitives.
Works through MCP or directly through the SDK.
The MCP server wraps the authority model for agent tools, while the SDK ships as a standalone engine for any runtime. Use it from Claude, Cursor, OpenAI Agents SDK, LangChain, CrewAI, backend workers, workflow engines, device services, or your own verifier. No framework owns the authority layer.
npx -y agent-envelope-mcpPublished on npm and listed in the official MCP Registry. Sovereign verification runs offline and free; hosted governance uses API keys for service metering, ledgers, and audit events while signatures prove authority. The SDK is the substrate, MCP is the runtime wrapper, and AgentEnvelope Web is the governance head.
Stop handing bearer tokens to software that acts.
Keep accounts and billing where they belong. Derive authority for actions.