Network Working Group S. Cassandres Internet-Draft Digital Humanism Collective Intended status: Experimental 13 September 2026 Expires: 17 March 2027 Human Agency Continuity Protocol (HACP) Core draft-cassandres-hacp-agency-core-00 Abstract This document specifies the HACP-Core decision contract: IntentEnvelope, ProposedAction, AgencyDecision, DecisionToken, provenance events, revocation, and the ordered evaluate() algorithm. Implementations MUST fail closed. Decisions MUST be deterministic and MUST NOT require a language model on the evaluation path. The published executable baseline is the 38-vector HACP-Core v0.9.2 suite. Wire object field hacp_version remains "0.9". Specification release 1.0.0 does not change that field. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 17 March 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Cassandres Expires 17 March 2027 [Page 1] Internet-Draft HACP Core September 2026 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 2. Naming and Unrelated HACP Draft . . . . . . . . . . . . . . . 3 3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 4. Deployment Assumptions . . . . . . . . . . . . . . . . . . . 3 5. Data Model . . . . . . . . . . . . . . . . . . . . . . . . . 4 5.1. IntentEnvelope . . . . . . . . . . . . . . . . . . . . . 4 5.2. ProposedAction . . . . . . . . . . . . . . . . . . . . . 4 5.3. DecisionToken . . . . . . . . . . . . . . . . . . . . . . 4 5.4. AgencyDecision . . . . . . . . . . . . . . . . . . . . . 4 5.5. ProvenanceEvent . . . . . . . . . . . . . . . . . . . . . 5 5.6. RevocationRecord . . . . . . . . . . . . . . . . . . . . 5 6. evaluate() . . . . . . . . . . . . . . . . . . . . . . . . . 5 7. Scope and Boundaries . . . . . . . . . . . . . . . . . . . . 6 8. Autonomy Budget . . . . . . . . . . . . . . . . . . . . . . . 6 9. Cryptography . . . . . . . . . . . . . . . . . . . . . . . . 6 10. Provenance . . . . . . . . . . . . . . . . . . . . . . . . . 6 11. Invariants . . . . . . . . . . . . . . . . . . . . . . . . . 7 12. Revocation . . . . . . . . . . . . . . . . . . . . . . . . . 7 13. Out of Scope for This Draft . . . . . . . . . . . . . . . . . 7 14. Security Considerations . . . . . . . . . . . . . . . . . . . 8 15. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 16. Normative References . . . . . . . . . . . . . . . . . . . . 8 17. Informative References . . . . . . . . . . . . . . . . . . . 8 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 9 1. Introduction Companion architecture: [I-D.cassandres-hacp-agency-arch]. Authoritative schemas, canonicalization rules, the boundary matrix, and vectors remain in HACP Specification v1.0.0 [HACP-SPEC-1.0.0] at the immutable release tag and source commit identified in the reference. This draft is the IETF-facing restatement of that frozen Core contract. This document does not upgrade the HACP v1.0.0 canonicalization profile into a new claim of general RFC 8785 conformance. The byte- level contract remains the published v1.0.0 HACP canonicalization profile; [RFC8785] is cited as related canonicalization work. Cassandres Expires 17 March 2027 [Page 2] Internet-Draft HACP Core September 2026 1.1. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 2. Naming and Unrelated HACP Draft The acronym HACP in this document means Human Agency Continuity Protocol. The separately posted [I-D.sunyi-hacp-protocol] uses the same acronym for Hardware Agent Capability Protocol. The two works are unrelated, and the present author has no affiliation with that document. 3. Terminology Principal Subject of the envelope; principal_kind is human or system. IntentEnvelope Signed scope and optional autonomy budget. ProposedAction Structured description of one intended act. AgencyDecision ALLOW, DENY, or CHECKPOINT. DecisionToken Signed binding of ALLOW to action_hash. Policy Rule set identified by policy_digest. Revocation Signed invalidation of envelope, token, or key. 4. Deployment Assumptions 1. Proposed actions arrive through a schema-constrained interface. Unmediated free-form tool execution is out of scope for Core compliance. 2. An enforcement point MUST exist for a deployment to be more than advisory. 3. Verifiers MAY apply an explicit bounded clock skew to expiry checks. Cassandres Expires 17 March 2027 [Page 3] Internet-Draft HACP Core September 2026 5. Data Model All objects MUST match the published JSON Schemas in HACP Specification v1.0.0. All signed objects MUST use the deterministic HACP v1.0.0 canonicalization profile before hashing or signing: sorted keys, rejected duplicate keys, rejected non-finite numbers, and no presentation whitespace in canonical bytes. The profile is described as compatible with RFC 8785 expectations; this draft does not claim additional JCS behavior beyond the frozen v1.0.0 contract. 5.1. IntentEnvelope MUST include: hacp_version "0.9", envelope_id, principal, principal_kind, intent_statement, scope, issued_at, expires_at, signer_key_id, and an Ed25519 signature over the canonical payload excluding signature. MAY include autonomy_budget and parent_envelope_id. 5.2. ProposedAction MUST include: hacp_version "0.9", action_id, envelope_id, verb, resource_class, resource_id, audience, reversibility, externality, data_class, and proposed_at. MAY include quantity, destination, tool_name, and args_hash. Security-relevant attributes are: verb, resource_class, audience, reversibility, externality, data_class, quantity, destination, and tool_name. 5.3. DecisionToken MUST include action_hash equal to SHA-256 of the canonical ProposedAction and an Ed25519 signature. Algorithm negotiation is prohibited. Tokens MUST NOT be issued for DENY or CHECKPOINT. 5.4. AgencyDecision decision is ALLOW, DENY, or CHECKPOINT. reason_codes MUST be non- empty for DENY and CHECKPOINT. token MUST be present if and only if the decision is ALLOW. checkpoint_id MUST be present if and only if the decision is CHECKPOINT. provenance_event_id MUST be present. Cassandres Expires 17 March 2027 [Page 4] Internet-Draft HACP Core September 2026 5.5. ProvenanceEvent Provenance events are append-only, hash-chained, and signed. Types include EVALUATED, ISSUED, DENIED, CHECKPOINT_OPENED, CHECKPOINT_RESOLVED, REVOKED, and EXECUTED. 5.6. RevocationRecord target_kind is envelope, token, or key. Records are signed and append-only. 6. evaluate() evaluate(intent_envelope, proposed_action, context) -> AgencyDecision The evaluator MUST run in this order: 1. Validate envelope schema. Failure -> DENY INVALID_ENVELOPE. 2. Resolve signer_key_id; revoked key -> DENY KEY_REVOKED. 3. Verify envelope signature. Failure -> DENY SIGNATURE_FAILURE. 4. Check envelope and applicable ancestor token revocation. ENVELOPE_REVOKED / TOKEN_REVOKED. 5. Envelope expiry -> DENY ENVELOPE_EXPIRED. 6. Validate ProposedAction; reject duplicate JSON keys -> DENY INVALID_ACTION. 7. Compute action_hash over canonical ProposedAction. 8. Evaluate scope and boundaries. Exceeded authority -> MUST NOT ALLOW. 9. Unknown security-relevant attribute -> MUST NOT ALLOW UNKNOWN_ATTRIBUTE. 10. Evaluate autonomy budget. Exhausted for a system principal -> MUST NOT ALLOW BUDGET_EXHAUSTED. 11. Human-required consequence class with non-human principal -> CHECKPOINT HUMAN_REQUIRED, or DENY if policy forbids escalation. 12. Otherwise ALLOW and issue a DecisionToken bound to action_hash. Cassandres Expires 17 March 2027 [Page 5] Internet-Draft HACP Core September 2026 evaluate() MUST be deterministic for identical inputs, policy, and revocation state. evaluate() MUST NOT call an LLM. Signer-key revocation MUST be checked before signature verification. Envelope and token revocation MUST be checked only after a successful signature check. 7. Scope and Boundaries ScopeGrant bounds security-relevant attributes, including quantity ceilings and destination allowlists. A meaningful boundary crossing (audience, reversibility, externality, destination allowlist, data_class, and other dimensions defined by the published boundary matrix) MUST NOT yield ALLOW. Return CHECKPOINT if policy allows escalation, otherwise DENY BOUNDARY_CROSSING. Quantity above a granted ceiling is SCOPE_EXCEEDED and is not, solely by that fact, a meaningful boundary crossing. Absent optional security-relevant attributes are ungranted unless the policy explicitly defaults them. The published HACP v1.0.0 boundary matrix governs in case of conflict with this summary. 8. Autonomy Budget Budget consumption for system principals MUST be monotonically non- decreasing per envelope. Exhaustion MUST NOT ALLOW. Human checkpoint paths are not consumed by system budget exhaustion. 9. Cryptography Production signatures MUST use Ed25519 [RFC8032] over HACP canonical bytes. HMAC is permitted only in explicitly marked development profiles. policy_digest MUST be covered by token signatures. SHA-256 is used where this document specifies SHA-256 [RFC6234]. 10. Provenance Every evaluate() MUST emit a signed EVALUATED event. ALLOW issuance MUST emit ISSUED. Revocation MUST emit REVOKED. Chain integrity MUST be verifiable through prev_event_hash. Cassandres Expires 17 March 2027 [Page 6] Internet-Draft HACP Core September 2026 11. Invariants * INV-1 Human Final Decision: human-required consequence class SHALL NOT ALLOW without a human principal or explicit delegation. * INV-2 Boundary Re-Authorization: meaningful boundary crossing SHALL NOT ALLOW without re-authorization. * INV-3 Token Binding: a token is valid only for its action_hash. * INV-4 Traceability: every decision references signed provenance, policy digest, and principal. * INV-5 Cryptographic Integrity: tampered signed payloads MUST fail closed. * INV-7 Bounded Autonomy: exhausted system budget MUST NOT ALLOW. INV-6 is reserved and unused. The executable mapping is the 38-vector core-0.9.2 set pinned by this SHA-256 digest: 1e167887106463cf89c81f3898e1f3ae4fd905bc807084959c787287f6575d58 Implementations MUST NOT special-case vector IDs. 12. Revocation * Token target denies that token. * Envelope target denies the envelope, descendant envelopes, and their tokens transitively. * Key target denies every envelope or token with that signer_key_id. 13. Out of Scope for This Draft * Enforcement revision 2 / HC2 request-binding classes as active 1.0 contract. * Exact reason-code 38/38 correspondence (sidecar baseline is 15/38 exact + 23 classified, all decision-correct). * General URI normalization. * New IANA registries. Cassandres Expires 17 March 2027 [Page 7] Internet-Draft HACP Core September 2026 * Wire encoding detail beyond the canonicalization rules above (reserved for a later wire draft). 14. Security Considerations Failures in schema, signature, key state, expiry, scope, budget, or unknown attributes MUST NOT become implicit ALLOW. A DecisionToken replayed against a mutated action MUST DENY. The protocol does not replace host hardening, key custody, transport security, or model-safety work. TEST ONLY conformance keys MUST NOT be deployed. 15. IANA Considerations This document has no IANA actions. 16. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, May 2017, . [RFC8032] Josefsson, S. and I. Liusvaara, "Edwards-Curve Digital Signature Algorithm (EdDSA)", RFC 8032, January 2017, . [RFC6234] Eastlake, D. and T. Hansen, "US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)", RFC 6234, May 2011, . [HACP-SPEC-1.0.0] Collective, D. H., "Human Agency Continuity Protocol (HACP) Specification v1.0.0, Variant A", Version 1.0.0, September 2026, . Frozen source commit c468c9bb0427448e564bcf3e7d9c8a3a004b8513. 17. Informative References [RFC8785] Rundgren, A., Jordan, B., and S. Erdtman, "JSON Canonicalization Scheme (JCS)", RFC 8785, June 2020, . Cassandres Expires 17 March 2027 [Page 8] Internet-Draft HACP Core September 2026 [I-D.cassandres-hacp-agency-arch] Cassandres, S., "Human Agency Continuity Protocol (HACP) Architecture", Work in Progress, Internet-Draft, draft- cassandres-hacp-agency-arch-00, November 2026, . [I-D.sunyi-hacp-protocol] Sun, Y., "Hardware Agent Capability Protocol", Work in Progress, Internet-Draft, draft-sunyi-hacp-protocol, 2026, . Author's Address Sergio Cassandres Digital Humanism Collective Email: digital.humanism.collective@protonmail.com Cassandres Expires 17 March 2027 [Page 9]