Agent Capability Tokens
The canonical version-1 CBOR envelope and its verification boundary.
ACT is a signed capability envelope. The source specification at act/SPECIFICATION.md is version 1, draft status. The published Rust implementation is agent-capability-token@0.1.0. It is not wire-compatible with CWT/COSE merely because it uses CBOR.
Envelope
| Field | Type | Contract |
|---|---|---|
v | unsigned integer | 1 for this implemented format |
alg | text | Ed25519 |
claims | byte string | Exact CBOR-encoded claim bytes |
sig | byte string | 64-byte Ed25519 signature over those exact claim bytes |
kid | optional text | Signing-key identifier |
The encoded token limit is 16,384 bytes. Check size before decoding. Relay original bytes; re-encoding the claims may change the signed message.
Claims
Required claims include jti, sub, iss, aud, iat, exp, tenant_id, and scope. aud accepts a string or array. Temporal values are integer epoch seconds. Optional nbf defaults to zero. cnf carries proof-of-possession metadata, delegation carries onward-delegation restrictions, and ext carries issuer-specific values.
The presence of cnf is not proof of possession: the calling protocol must require and verify the actual possession proof. Issuer-specific budgets, rate limits and revocation distribution are application policy, not automatically enforced by the byte-format parser.
Verify in order
Validate envelope size/shape/version/algorithm and signature shape. Verify the signature over the original claims bytes before trusting claim policy. Then validate the decoded claims against configured time, issuer, audience and required scope. Do not treat an unsupported format version as a signature forgery.
Use the complete ACT signing and verification example. The first-agent quickstart uses a separate possession-proof protocol. Public keys, issuer, audience and scope requirements must come from trusted service configuration. When using @openagentid/crypto-wasm@0.1.1, supply the current receiver clock through the SDK's .atTime(...) on every verification; that published binding cannot use its default WASM system-clock path.
Scope and delegation
Scopes use service:resource:action. Parse and compare them with the canonical scope type; avoid ad hoc substring matching. Delegated tokens must obey their parent scope, depth, delegate and lifetime restrictions. Inspect the actual claim and delegation types for optional fields and validation semantics.
Token conformance does not certify cross-language encryption-key restoration, a live broker, or privileged authority. See conformance evidence and broker policy.