Documentation for derived authority.
AgentEnvelope is the hosted governance head around an open authority engine. The SDK derives and verifies scoped capabilities; MCP exposes that model to runtimes; the web console adds vaults, records, ledgers, billing, and audit controls.
The rule is simple: if something performs an action or carries delegated authority, that action can carry deterministic, scoped, decaying authority that anyone can verify.
The three surfaces
These are separate on purpose. The SDK is the sovereign engine, MCP is the runtime wrapper, and AgentEnvelope Web is the governance authority head.
Sovereign SDK
The open cryptographic engine. Derive roots, domains, action envelopes, capabilities, signatures, and offline verification without an account, API key, or AgentEnvelope server.
MCP runtime wrapper
The bridge for tool hosts and agent runtimes. MCP exposes the same authority model to Claude, Cursor, coding agents, workflows, and custom orchestrators.
AgentEnvelope Web
The hosted governance head. Use it for browser-held vaults, hosted minting, public records, API-keyed routes, ledgers, billing, audit exports, and team continuity.
The authority chain
Authority flows from a root through deterministic scopes. The same inputs produce the same identities, and a compromised capability reveals nothing about its siblings, domain, or root.
Root
The sovereign source of authority. In browser-held custody, the root is encrypted in your vault and never leaves the browser.
Domain
A deterministic branch for a class of work, such as support operations, data exports, workflow approvals, or device access.
Action envelope
The permission boundary: operation, resources, time window, decay mode, and usage limit.
Capability
Scoped signing material for one action envelope. It is authority, not a bearer reference to authority somewhere else.
Signed action
The runtime signs the payload it wants to execute with the capability seed.
Verification
A verifier checks the signature, expected address, scope, time window, and public record. This can run offline with the SDK.
Why ordinary credentials fail for delegated action
API keys, OAuth tokens, JWTs, and service secrets still have a role for account access, billing, and hosted service control. They are weak as the authority layer for actors that perform specific jobs.
Actors inherit human authority
A runtime often acts by holding a human API key, OAuth token, JWT, service secret, or shared credential. It has no bounded authority of its own.
A leak gets the whole account
Shared secrets are bearer credentials. When one leaks, the blast radius is everything that credential can touch, not the single task the actor needed.
The action itself proves nothing
Bearer tokens carry no native proof of action scope. You cannot prove which actor acted, under whose authority, or within what limit.
AgentEnvelope is the counter-pattern: derive action authority instead of handing out broad bearer authority.
Choose your integration path
Start with the smallest surface that solves your authority problem. You can use the SDK alone, wrap it with MCP, or add AgentEnvelope Web when governance and audit controls matter.
Use the SDK offline
Use self-held roots in your own app, backend, worker, or verifier. No account. No hosted API. No network requirement for signing or verification.
Add MCP to a runtime
Expose derived authority to a tool host or agent runtime. The runtime plans and executes; AgentEnvelope material proves what the action is allowed to do.
Govern with AgentEnvelope Web
Use the portal when teams need hosted minting, vault continuity, public records, API keys, ledgers, billing, and audit exports.
Runnable example
The example repository shows the SDK and MCP authority model in a small working project, separate from the hosted governance portal.
github.com/BlackBoxEngineering/agent-envelope-exampleWhat it is for
AI agents created the immediate pressure, but they are not the boundary of the problem. The same authority gap appears wherever software performs work.
AI agents
LLM agents, multi-agent systems, tool runners, browser automation, coding agents, support agents, and SRE agents.
Workers and services
Node, Python, Go, Rust, Java, .NET, Lambda, edge workers, APIs, and service-to-service calls.
Workflows and automation
Temporal, Step Functions, Airflow, Prefect, Dagster, n8n, CI/CD, Zapier, and Make steps.
Bots and scripts
Slack, Discord, Telegram, email, scraping, browser automation, CLI jobs, cron jobs, and one-off runbooks.
Orders and instructions
Purchase orders, work orders, approvals, dispatch instructions, delegated commands, and signed intent.
Permissions and devices
Temporary hotel keys, facility access, device unlocks, smart homes, robotics, IoT, drones, and fleets.
Data systems
ETL jobs, ingestion pipelines, analytics workers, ML training, feature stores, exports, and transforms.
Enterprise IAM
Zero-trust machine actors, endpoint-specific signing, mTLS-adjacent service identity, and verifier-safe records.
Governed web flow
AgentEnvelope Web is useful when a team needs continuity and auditability around the same cryptographic model. API keys meter hosted services; signatures prove authority.
Create an account
Your account gates the hosted workspace. It does not become the source of action authority.
Create a vault
Generate an encrypted identity vault in the browser. Use a vault passphrase separate from your login password.
Derive domains
Create domain branches for classes of work. Domain keys remain inside the vault custody boundary.
Mint bounded capabilities
Define an action envelope and mint a capability for one operation, resource scope, time window, and limit.
Run your actor
Give the actor only the capability it needs. The actor signs actions; it never sees the vault, domain seed, or siblings.
Verify and audit
Verify locally with the SDK or through hosted endpoints. Publish verifier-safe records, ledgers, receipts, and audit exports when governance needs them.
Custody boundary
AgentEnvelope is designed around one principle: the hosted platform should not become the permanent holder of customer authority. Custody clarity means knowing whose keys they are, where they live, and what the platform is allowed to do.
Browser-held vault
The vault ciphertext can sync to the hosted workspace for continuity across devices. The passphrase and root never leave the browser.
External custody
Keep authority in your own backend, HSM, KMS, or wallet. Register public verifier metadata with AgentEnvelope Web when you need hosted records.
SDK runtime
Use the SDK inside your own apps, workers, Lambdas, pipelines, services, and verifiers. The SDK is the production authority surface.
What AgentEnvelope Web never stores
In sovereign browser mode, the hosted backend never receives your vault passphrase, master seed, domain seed, action seed, or private capability pack. It stores encrypted vault ciphertext, public domain projections, safe action-envelope metadata, public verifier records, and event logs. The backend remembers the workspace. The vault remembers the authority.
Capability handoff
A capability JSON contains actionSeedHex. This is not a token or a reference to authority held elsewhere. It is the authority. Treat it like a private key: never log it, never sync it, never persist it.
If it leaks, the blast radius is one capability: not the domain, not the vault, not any sibling.
Hosted attestation pin
Hosted verify reports and mint receipts can carry an AgentEnvelope attestation. Verifiers pin the public attester address when checking those receipts with the SDK.
0x2332d1b716a49a520d9a2de6baebeb5bdafdf994
Start deriving authority.
Use the SDK offline, connect it to runtimes with MCP, or open AgentEnvelope Web when you need hosted governance, API keys, ledgers, and audit controls.