Documentation for derived authority.
AgentEnvelope Web is the hosted customer portal around an open authority engine. The SDK derives and verifies scoped capabilities; MCP exposes that model to runtimes; the web console adds vaults, legitimacy state, records, ledgers, billing, and audit controls.
The rule is simple: if something performs an action or carries delegated authority, that action can carry deterministic, scoped, decaying authority that anyone can verify.
The three surfaces
These are separate on purpose. The SDK is the sovereign engine, MCP is the runtime adapter, and AgentEnvelope Web is the optional hosted portal for records, legitimacy, ledgers, API access, and external integrations.
Sovereign SDK
The open cryptographic engine. Derive roots, domains, action envelopes, capabilities, signatures, and offline verification without an account, API key, or AgentEnvelope server.
MCP adapter
The bridge for tool hosts and agent runtimes. MCP exposes the same authority model to Claude, Cursor, coding agents, workflows, and custom orchestrators.
AgentEnvelope Web
The hosted customer portal. Use it for browser-held Vault custody, hosted minting, legitimacy state, public records, API-keyed routes, ledgers, billing, and audit exports.
What is an AgentEnvelope Domain?
A Domain is a separate cryptographic authority branch derived from your Vault for one system, customer, factory, service, workflow, deployment, or other area of work.
What stays inside it?
Its agents, operations, authority, legitimacy, and records. Authority derived for one Domain is not authority for another Domain.
When should you create another?
Create another Domain when the work needs its own authority boundary, operators, audit history, customer separation, or independent revocation decisions. Do not create a Domain for every individual action.
What is it used for?
The Domain workspace brings its Agents, Operations, Authority, Legitimacy, and Records together. Protocol details expose its address, fingerprint, proofs, and signed objects.
What is a MintDelegate?
A MintDelegate is a Domain-signed permit held by a runtime, bot, service, or device. It lets that holder mint bounded action capabilities without receiving the Vault root or Domain seed.
See the SDK mint example ->What does it bound?
The permitted operations and resources, action-index range, validity window, mint and use limits, accepted bot identities, and optional legitimacy requirement.
What does the runtime receive?
The signed delegate and Domain-scoped mint material needed to derive capabilities. It never receives the Vault root or raw Domain seed.
What happens after revocation?
Hosted mint rejects future requests made through that delegate. Revocation does not erase earlier records or cryptographic history.
What is an AgentEnvelope record?
A record is the verifier-safe public evidence for an AgentEnvelope actor or action. It lets another party verify authority without receiving the vault root, domain seed, action seed, or other private signing material.
What does it contain?
Public identity and authority commitments such as the actor address, operation, resources, time window, Domain binding, and optional legitimacy reference.
What does it prove?
A verifier can check that a signed action matches its published authority. A record does not by itself prove that a physical or external action completed successfully.
Where is it verified?
Verification can run offline with the SDK or through the hosted API. The Records page is the account-wide registry; each Domain also has its own filtered Records tab.
The authority chain
Authority flows from a root through deterministic scopes. The same inputs produce the same identities, and a compromised capability reveals nothing about its siblings, domain, or root.
Root
The sovereign source of authority. In browser-held custody, the root is encrypted in your vault and never leaves the browser.
Domain
A deterministic branch for a class of work, such as support operations, data exports, workflow approvals, or device access.
Action envelope
The permission boundary: operation, resources, time window, decay mode, and usage limit.
Capability
Scoped signing material for one action envelope. It is authority, not a bearer reference to authority somewhere else.
Legitimacy
Hosted evidence state for whether delegated authority is still admissible under current reality. Required delegate refs are enforced by hosted mint.
Signed action
The runtime signs the payload it wants to execute with the capability seed.
Verification
A verifier checks the signature, expected address, scope, time window, and public record. This can run offline with the SDK.
Why ordinary credentials fail for delegated action
API keys, OAuth tokens, JWTs, and service secrets still have a role for account access, billing, and hosted service control. They are weak as the authority layer for actors that perform specific jobs.
Actors inherit human authority
A runtime often acts by holding a human API key, OAuth token, JWT, service secret, or shared credential. It has no bounded authority of its own.
A leak gets the whole account
Shared secrets are bearer credentials. When one leaks, the blast radius is everything that credential can touch, not the single task the actor needed.
The action itself proves nothing
Bearer tokens carry no native proof of action scope. You cannot prove which actor acted, under whose authority, or within what limit.
AgentEnvelope is the counter-pattern: derive action authority instead of handing out broad bearer authority.
Choose your integration path
Start with the smallest surface that solves your authority problem. You can use the SDK alone, wrap it with MCP, or add AgentEnvelope Web when governance and audit controls matter.
Use the SDK offline
Use self-held roots in your own app, backend, worker, or verifier. No account. No hosted API. No network requirement for signing or verification.
Add MCP to a runtime
Expose derived authority to a tool host or agent runtime. The runtime plans and executes; AgentEnvelope material proves what the action is allowed to do.
Govern with AgentEnvelope Web
Use the portal when operators need hosted minting, legitimacy checks, vault continuity, public records, API keys, ledgers, billing, and audit exports.
Runnable example
The example repository shows the SDK and MCP authority model in a small working system, separate from the optional hosted service.
github.com/BlackBoxEngineering/agent-envelope-exampleWhat it is for
AI agents created the immediate pressure, but they are not the boundary of the problem. The same authority gap appears wherever software performs work.
AI agents
LLM agents, multi-agent systems, tool runners, browser automation, coding agents, support agents, and SRE agents.
Workers and services
Node, Python, Go, Rust, Java, .NET, Lambda, edge workers, APIs, and service-to-service calls.
Workflows and automation
Temporal, Step Functions, Airflow, Prefect, Dagster, n8n, CI/CD, Zapier, and Make steps.
Bots and scripts
Slack, Discord, Telegram, email, scraping, browser automation, CLI jobs, cron jobs, and one-off runbooks.
Orders and instructions
Purchase orders, work orders, approvals, dispatch instructions, delegated commands, and signed intent.
Permissions and devices
Temporary hotel keys, facility access, device unlocks, smart homes, robotics, IoT, drones, and fleets.
Data systems
ETL jobs, ingestion pipelines, analytics workers, ML training, feature stores, exports, and transforms.
Enterprise IAM
Zero-trust machine actors, endpoint-specific signing, mTLS-adjacent service identity, and verifier-safe records.
Governed web flow
AgentEnvelope Web is useful when an operator needs continuity and auditability around the same cryptographic model. API keys meter hosted services; legitimacy state records current admissibility; signatures prove authority.
Create an account
Your account gates the hosted workspace. It does not become the source of action authority.
Create a vault
Generate an encrypted identity vault in the browser. Use a vault passphrase separate from your login password.
Derive domains
Create domain branches for classes of work. Domain keys remain inside the vault custody boundary.
Mint bounded capabilities
Define an action envelope and mint a capability for one operation, resource scope, time window, and limit. Delegates can require a matching legitimacy state before hosted mint authorises the request.
Run your actor
Give the actor only the capability it needs. The actor signs actions; it never sees the vault, domain seed, or siblings.
Verify and audit
Verify locally with the SDK or through hosted endpoints. Publish verifier-safe records, legitimacy decisions, ledgers, receipts, and audit exports when governance needs them.
Custody boundary
AgentEnvelope is designed around one principle: the hosted platform should not become the permanent holder of customer authority. Custody clarity means knowing whose keys they are, where they live, and what the platform is allowed to do.
Browser-held vault
The vault ciphertext can sync to the hosted workspace for continuity across devices. The passphrase and root never leave the browser.
External custody
Keep authority in your own backend, HSM, KMS, or wallet. Register public verifier metadata with AgentEnvelope Web when you need hosted records.
SDK runtime
Use the SDK inside your own apps, workers, Lambdas, pipelines, services, and verifiers. The SDK is the production authority surface.
What AgentEnvelope Web never stores
In sovereign browser mode, the hosted backend never receives your vault passphrase, master seed, domain seed, action seed, or private capability pack. It stores encrypted vault ciphertext, public domain projections, safe action-envelope metadata, public verifier records, hosted legitimacy state, stored delegates, and event logs. The backend remembers the workspace. The vault remembers the authority.
Capability handoff
A capability JSON contains actionSeedHex. This is not a token or a reference to authority held elsewhere. It is the authority. Treat it like a private key: never log it, never sync it, never persist it.
If it leaks, the blast radius is one capability: not the domain, not the vault, not any sibling.
Hosted attestation pin
Hosted verify reports and mint receipts can carry an AgentEnvelope attestation. Verifiers pin the public attester address when checking a report or receipt with the SDK.
0x2332d1b716a49a520d9a2de6baebeb5bdafdf994
Start deriving authority.
Use the SDK offline, connect it to runtimes with MCP, or open AgentEnvelope Web when you need hosted records, legitimacy checks, API keys, ledgers, and audit controls.