Machine workflow

Check authority before the agent acts.

Use ScopeProof immediately before a consequential HTTP request, MCP tool call, payment, file action, message, shell command, or generic action. The service evaluates structured authority metadata only and never executes the target action.

OpenAPI contractCapabilities

Workflow

  1. Build a structured authority envelope with an authority ID, expiry, permissions, explicit denies, limits, and any configured approval requirements.
  2. Describe the exact proposed action using structured metadata only.
  3. Optionally call scopeproof.preflight for free structural and secret-safety validation. Preflight intentionally returns no authorization verdict.
  4. Call scopeproof.check_action or POST /v1/check-action. Eligible requests receive an exact $0.01 stablecoin payment challenge.
  5. After settlement, read the decision and reason codes, then verify the returned scopeproof-receipt.v1 using scopeproof.verify_receipt or the public JWKS.
  6. Apply your own issuer-trust and execution policy. ScopeProof never executes the proposed action.

Never send

  • Raw prompts
  • Passwords or API keys
  • Cookies or Authorization headers
  • Private keys or payment credentials
  • Arbitrary target request bodies

Trust boundary

ScopeProof evaluates the action against the authority envelope it receives. It does not independently authenticate the authority issuer or prove that a caller-asserted human approval is genuine.

Your downstream enforcement point remains responsible for choosing trusted issuers and accepted authority digests.