Matthew Koepp | arXiv Science

arXiv2026

Provable Authority: A Protocol for Verifiable Authority Resolution and Control Across Human, Organizational, and Agentic Transactions

Payment systems authenticate users, devices, accounts, and cryptographic credentials, but a relying party, such as a counterparty, payment rail, marketplace, or autonomous agent runtime, generally cannot obtain compact, independently verifiable evidence that the party presenting one exact transaction holds current organizational authority to execute it under the applicable evidence, policy, budget, and approval state. Agentic commerce makes this gap operationally urgent: a software agent can produce a valid signature while acting outside its delegated purpose, after its sponsor's authority has changed, or on transaction details that differ from those a human approved. We describe the ChainIT Authority Protocol, a subject-neutral and rail-neutral pre-execution authority and evidence control plane. The protocol separates durable identity, a versioned organizational authority record (the Authority Resolution Pactvera), sourced evidence assertions, deterministic reason-coded policy predicates, and organization-configured dispositions; binds each decision and human approval to a canonical transaction digest; reserves capacity atomically so that limits hold under concurrency; and authorizes commit only through a single-use, sender-constrained Execution Authorization Credential consumed at the rail adapter, with append-only lifecycle evidence sealed after the terminal outcome. An Agent Subject Profile adds the workload registration, attested key hierarchy, and sovereignty boundary required when the acting subject is an AI agent, without introducing a separate authority concept. We specify the commit-time execution predicate and bounded-freshness status rules, give enforcement profiles for fiat (ACH, wire, card, instant payment) and stablecoin rails, and state residual risks and non-goals.

cs.CR↗

arXiv2026

Provable Compliance: A Protocol for Runtime Compliance Evidence and Transaction-Specific Decisioning

Regulated institutions already perform onboarding, screening, monitoring, and review, but compliance evidence ages, and whether it supports a decision depends on the institution, product, subject, counterparty, transaction, jurisdiction, risk tier, and purpose. A relying party therefore often cannot obtain compact, attributable proof of which evidence, policy, authority, and transaction context were current when a decision was made, a gap that grows as authority is delegated to software agents and scheduled workflows. We describe ChainIT Provable Compliance, the compliance-side layer of the ChainIT Authority Protocol. Each sourced or institution-generated fact is represented as a separate Evidence Assertion VDT with provenance, freshness, confidence, permitted purpose, and privacy classification; a versioned Compliance Policy Profile selects the applicable rules; a Business Rules Engine returns deterministic, reason-coded predicate results; and the organization's configured Workflow Engine composes them into a signed, time-bounded Compliance Decision VDT for one reliance event. The decision contributes a single predicate, Compliance Decision Permits, to session-eligibility and transaction-policy decisions. It never independently authorizes payment: only a final Allow together with an exact transaction digest, atomic capacity reservation, and a single-use execution credential can commit value. The paper specifies point-of-reliance freshness, scoped propagation of evidence changes, decision states, evidence domains (AML, sanctions, PEP, background, identity, and licensing), the U.S. and FATF regulatory context as of August 2026, privacy and disclosure controls, and residual risks.

cs.CR↗