Examples — Rough, Self-Implementable Artifacts

# Minimal Verifiable Authority Manifest v0.1
# Layers demonstrated: 1 (Intent), 2 (Authority), 4 (Policy)
# NOT demonstrated: 3 (Context), 5 (Execution), 6 (Evidence), 7 (Review)

manifest_version: "0.1"
manifest_id: "vam-2026-001"
created_at: "2026-07-04T10:00:00Z"
created_by: "human:[EMAIL]"              # Layer 1: Intent origin

# Layer 1: Intent Capture
intent:
  description: "Read-only query of customer order history for support ticket #4821"
  requested_by: "human:[EMAIL]"
  timestamp: "2026-07-04T10:00:00Z"
  scope: "read:orders:customer:4821"
  # In production, sign this intent record

# Layer 2: Authority Delegation
authorization:
  envelope_id: "env-2026-07-04-001"
  actor:
    type: "agent"
    identifier: "agent:[EMAIL]"
    role: "support-reader"
  granted_by: "human:[EMAIL]"
  valid_from: "2026-07-04T10:00:00Z"
  valid_until: "2026-07-04T10:30:00Z"    # Time-bounded (30 min)
  scope:
    - "read:orders:customer:4821"
    - "read:customer:profile:4821"

# Layer 4: Policy Decision
policy:
  decision_id: "pol-2026-07-04-001"
  rule_set: "support-access-v1"
  decision: "allow"
  matched_rules:
    - rule_id: "support-reader-read-own-tickets"
      condition: "actor.role == 'support-reader' AND intent.scope.startsWith('read:orders:customer:')"
      outcome: "allow"
  evaluated_at: "2026-07-04T10:00:05Z"

# Layers 3, 5, 6, 7: Not in this minimal example

// Rust Authorization Envelope v0.1
// Layers demonstrated: 2 (Authority), 5 (Execution)

use std::time::{SystemTime, UNIX_EPOCH};

/// Layer 2: Who may act, within what scope, for how long
#[derive(Debug, Clone)]
pub struct AuthorizationEnvelope {
    pub envelope_id: String,
    pub actor_id: String,
    pub scopes: Vec<String>,
    pub valid_from: u64,
    pub valid_until: u64,
    pub granted_by: String,
}

impl AuthorizationEnvelope {
    /// Check if envelope is valid for a required scope at a given time
    pub fn allows(&self, required_scope: &str, now: u64) -> bool {
        if !(self.valid_from <= now && now <= self.valid_until) {
            return false;
        }
        self.scopes.iter().any(|scope| scope_matches(scope, required_scope))
    }
}

/// Layer 2: Wildcard scope matching (e.g., "read:*" matches "read:orders:4821")
fn scope_matches(granted: &str, required: &str) -> bool {
    if let Some(prefix) = granted.strip_suffix('*') {
        required.starts_with(prefix)
    } else {
        granted == required
    }
}

/// Layer 5: Execution envelope wrapper
pub fn execute_with_envelope<F, R>(
    envelope: &AuthorizationEnvelope,
    required_scope: &str,
    action: F,
) -> Result<R, String>
where
    F: FnOnce() -> R,
{
    let now = current_timestamp();
    if envelope.allows(required_scope, now) {
        Ok(action())
    } else {
        Err(format!(
            "Authorization invalid for scope '{}' at timestamp {}",
            required_scope, now
        ))
    }
}

fn current_timestamp() -> u64 {
    SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_secs()
}

// Usage:
// let envelope = AuthorizationEnvelope {
//     envelope_id: "auth-demo-001".to_string(),
//     actor_id: "agent:support-bot".to_string(),
//     scopes: vec!["read:orders:*".to_string()],
//     valid_from: current_timestamp() - 60,
//     valid_until: current_timestamp() + 1800,
//     granted_by: "human:[EMAIL]".to_string(),
// };
// let result = execute_with_envelope(&envelope, "read:orders:customer:4821", || get_customer_orders("4821"))
//     .expect("Authorization should have succeeded");

# Elixir Evidence Event Pipeline v0.1
# Layers demonstrated: 5 (Execution), 6 (Evidence), 7 (Review)

defmodule EvidenceEvent do
  @enforce_keys [:id, :actor, :action, :scope, :result_hash, :timestamp]
  defstruct [
    :id, :actor, :action, :scope, :result_hash, :timestamp,
    :previous_hash, :envelope_ref, :policy_decision_ref
  ]

  @doc "Create a new evidence event with hash chain linkage"
  def new(attrs) do
    event = %__MODULE__{
      id: attrs[:id] || Ecto.UUID.generate(),
      actor: attrs[:actor], action: attrs[:action],
      scope: attrs[:scope], result_hash: attrs[:result_hash],
      timestamp: attrs[:timestamp] || DateTime.utc_now(),
      previous_hash: attrs[:previous_hash],
      envelope_ref: attrs[:envelope_ref],
      policy_decision_ref: attrs[:policy_decision_ref]
    }
    {event, compute_hash(event)}
  end

  defp compute_hash(event) do
    data = %{
      id: event.id, actor: event.actor, action: event.action,
      scope: event.scope, result_hash: event.result_hash,
      timestamp: event.timestamp
    }
    :crypto.hash(:sha256, :erlang.term_to_binary(data)) |> Base.encode16()
  end
end

defmodule EvidenceChain do
  use GenServer

  def start_link(opts \\ []) do
    GenServer.start_link(__MODULE__, %{events: [], last_hash: nil}, opts)
  end

  def append_event(server, attrs) do
    GenServer.call(server, {:append, attrs})
  end

  def get_chain(server) do
    GenServer.call(server, :get_chain)
  end

  @impl true
  def init(state), do: {:ok, state}

  @impl true
  def handle_call({:append, attrs}, _from, state) do
    prev_hash = state.last_hash
    {event, hash} = EvidenceEvent.new(Map.put(attrs, :previous_hash, prev_hash))
    new_state = %{events: [event | state.events], last_hash: hash}
    {:reply, {:ok, hash}, new_state}
  end

  @impl true
  def handle_call(:get_chain, _from, state) do
    {:reply, {:ok, Enum.reverse(state.events)}, state}
  end
end

# In supervision tree:
# children = [{EvidenceChain, name: EvidenceChain}]
# Supervisor.start_link(children, strategy: :one_for_one)

# Usage:
# {:ok, hash} = EvidenceChain.append_event(EvidenceChain, %{
#   actor: "agent:support-bot", action: "get_customer_orders",
#   scope: "read:orders:customer:4821", result_hash: "sha256:...",
#   envelope_ref: "env-2026-07-04-001", policy_decision_ref: "pol-2026-07-04-001"
# })