---
title: "Mission-Bound Authorization on the Wire"
date: "2026-06-06T20:15:00-07:00"
lastmod: "2026-06-06T20:15:00-07:00"
description: "The running example of the Mission-Bound Authorization series as actual protocol exhibits: the PAR submission, the Mission-bound token, the AuthZEN permit and denial, the revocation, the lifecycle event, and the status check that stops the resume. Authorization for AI agents, byte by byte."
summary: "The series argues the architecture. This appendix shows the bytes: a Mission Intent submitted through PAR, the approved record\u0026rsquo;s integrity anchors, a Mission-bound access token, an AuthZEN permit bound to parameters, a parameter_violation denial, the revocation that ends the task, the lifecycle event that announces it, and the status check that fails the 02:00 resume. Every exhibit follows the current editor\u0026rsquo;s copies, and the two integrity anchors reproduce byte for byte."
slug: "mission-bound-authorization-on-the-wire"
tags:
  - "OAuth"
  - "Authorization"
  - "Agentic Identity"
  - "Mission-Bound Authorization"
  - "AuthZEN"
  - "Internet-Draft"
---


{{< spine steps="intent,mission,authority,enforcement" >}}

The [architecture series](/series/mission-bound-authorization/)
carries the argument, the
[Building Mission-Bound Authorization](/series/building-mission-bound-authorization/)
series carries the controls this appendix accompanies, and the
[Field Reference](/notes/mission-bound-authorization-reference/)
carries the definitions. This appendix carries the bytes: the
[running example](/notes/mission-bound-authorization-reference/#the-running-example-end-to-end),
Alice's Q3 board packet, as the protocol exhibits an implementer would
actually see. Exhibits follow the draft family's editor's copies as of
July 6, 2026, and the drafts are the normative text. Standard OAuth
parameters that carry no Mission semantics are elided. Identifiers,
keys, and digests are illustrative, with two exceptions: `intent_hash`
and `authority_hash` reproduce byte for byte from the
[test vector](/notes/mission-bound-authorization-reference/#reproducible-test-vector),
and the two `parameter_digest` values are real SHA-256 digests over the
JCS form of the parameter objects shown.

# 1. The proposal: Mission Intent via PAR

The shaper turned Alice's request into a candidate Mission Intent
([From a Request to an Approved Mission](/notes/mission-approval-integrity/)),
and the client submits it through a Pushed Authorization Request. The
`mission_intent` parameter value is the UTF-8 JSON serialization of the
Intent object, form-encoded on the wire. Decoded:

```json
{
  "goal": "Prepare the Q3 board packet for the audit committee",
  "purpose": "urn:example:mission:board-packet",
  "resources": ["https://finance.example.com",
    "https://docs.example.com",
    "https://workflow.example.com"],
  "constraints": ["Q3 2026", "Example Corp", "confidential"],
  "expires_at": "2026-10-15T18:00:00Z"
}
```

The client never sends `authorization_details` alongside
`mission_intent`. It proposes a task. The Authorization Server derives
the authority.

# 2. The pivot: the approved record

The Authorization Server validates the Intent, derives the Authority
Set (`query_financials`, `create_doc`, `notify_reviewer`), renders the
disclosure, and on Alice's approval commits the Mission atomically. The
[concrete record](/notes/mission-bound-authorization-reference/#a-concrete-mission-record)
lives in the Reference. The two anchors it commits are the ones every
later exhibit carries:

| Anchor | Value |
| --- | --- |
| `intent_hash` | `sha-256:jjx06KDh_TpWYhzSAvzEBH_lMz32eRj1tjgjNvt-crE` |
| `authority_hash` | `sha-256:4hRwrGkW9Jdjbkj1oHJ3opg9HRvmRe30k7TQmUfiIpY` |

# 3. The projection: a Mission-bound token

The agent asks for authority to read the financials. Issuance is a
derivation, gated on the Mission being `active`, and the response
echoes the narrowed grant and the `mission_id` reference:

```json
{
  "access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImF0K2p3dCJ9...",
  "token_type": "DPoP",
  "expires_in": 300,
  "mission_id": "msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1",
  "authorization_details": [
    { "type": "mission_resource_access",
      "resource": "https://finance.example.com",
      "actions": ["query_financials"],
      "constraints": { "period": "Q3 2026" } }
  ]
}
```

The decoded access-token claims carry the projection: a subset of the
Authority Set, a sender-constraint key, and the `mission` claim that
binds the credential back to the governance record. The token's `exp`
is minutes away. The Mission's `expires_at` is weeks away. That
asymmetry is the Durability law.

```json
{
  "iss": "https://as.example.com",
  "sub": "alice@example.com",
  "aud": "https://finance.example.com",
  "client_id": "s6BhdRkqt3",
  "iat": 1790812980,
  "exp": 1790813280,
  "jti": "at_3Vq8nK2xT6mR9sY1pZ4d",
  "authorization_details": [
    { "type": "mission_resource_access",
      "resource": "https://finance.example.com",
      "actions": ["query_financials"],
      "constraints": { "period": "Q3 2026" } }
  ],
  "cnf": { "jkt": "0ZcOCORZNYy-DWpqq30jZyJGHTN0d2HglBV3uiguA4I" },
  "mission": {
    "id": "msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1",
    "issuer": "https://as.example.com",
    "authority_hash":
      "sha-256:4hRwrGkW9Jdjbkj1oHJ3opg9HRvmRe30k7TQmUfiIpY"
  }
}
```

# 4. The gate: an AuthZEN permit, bound to parameters

The packet is drafted and the agent notifies the audit committee. The
notify is externally visible, so the PEP at `workflow.example.com`
asks the PDP before acting ([Mission-Bound Runtime Enforcement](/notes/mission-bound-runtime-enforcement-profile/),
[AuthZEN binding](https://mcguinness.github.io/mission-bound-authorization/#go.draft-mcguinness-mission-authzen.html)).
The Mission, actor, parameters, and freshness ride in `context`:

```json
{
  "subject": {
    "type": "user",
    "id": "alice@example.com",
    "properties": { "iss": "https://login.example.com" }
  },
  "resource": {
    "type": "notification",
    "id": "notif_board_packet_q3"
  },
  "action": { "name": "notify_reviewer" },
  "context": {
    "mission": {
      "id": "msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1",
      "issuer": "https://as.example.com",
      "authority_hash":
        "sha-256:4hRwrGkW9Jdjbkj1oHJ3opg9HRvmRe30k7TQmUfiIpY",
      "state": "active",
      "policy_version": "deploy-policy:v17"
    },
    "actor": { "client_id": "s6BhdRkqt3" },
    "parameters": {
      "group": "audit-committee",
      "message": "Q3 board packet is ready for review"
    },
    "parameter_digest":
      "sha-256:DCTAlrBUhQwW_t1EDxHCjdNkLbrT_Bc6nCLYkQubRU4",
    "audience": "https://workflow.example.com"
  }
}
```

The permit comes back bound to exactly those parameters, with a
single-use decision identifier because the action is externally
visible:

```json
{
  "decision": true,
  "context": {
    "decision_id": "dec_2FpQ8kV5nR1tX7mB4sJ9eL6wYc",
    "action_class": "external_commitment",
    "class_source": "deployment",
    "parameter_digest":
      "sha-256:DCTAlrBUhQwW_t1EDxHCjdNkLbrT_Bc6nCLYkQubRU4",
    "permit_expires_at": "2026-09-30T18:06:00Z",
    "single_use": true
  }
}
```

The executing PEP recomputes the digest against the parameters it is
about to use. Change the message after the permit and the digest
mismatches. That is the TOCTOU gap, closed.

# 5. The refusal: `parameter_violation`

Steered by a prompt-injected document, the agent tries the same notify
against a different audience. The Authority Set's constraint names
`audit-committee`, so the evaluation succeeds and the decision is no:

```json
{
  "decision": false,
  "context": {
    "decision_id": "dec_6JwN3xT9rQ4mV8kP1sB5eZ2yLd",
    "denial_reason": "parameter_violation",
    "action_class": "external_commitment",
    "class_source": "deployment",
    "parameter_digest":
      "sha-256:_0sG_Vm6EFHvqL5MMNYp-iL1KXXW5CGMr3NLXcXbKrc"
  }
}
```

A denial is a successful evaluation, not a transport error, and it
lands in the evidence trail with the same `decision_id` discipline as a
permit.

# 6. The stop: revocation by `mission_id`

At 23:00 the board meeting is cancelled and an administrator ends the
task at the lifecycle endpoint ([Mission Lifecycle and Change](/notes/mission-lifecycle-and-change/)).
One authenticated call, keyed by the Mission, touching no token:

```http
POST /as/mission/lifecycle HTTP/1.1
Host: as.example.com
Content-Type: application/x-www-form-urlencoded
Authorization: DPoP eyJhbGciOiJFUzI1NiIsImtpZCI6...

mission=msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1
&operation=revoke
&reason=Board+meeting+cancelled
&nonce=nonce_8Y3vN0sM6tP1xR9bQ5
```

# 7. The announcement: a lifecycle event

Subscribed consumers learn the transition through the experimental
Signals push, a Security Event Token whose strictly monotonic
`version` makes replayed or reordered events harmless. Decoded:

```json
{
  "iss": "https://as.example.com",
  "jti": "set_5R8wQ2kN7mX4vT1pB6zJ3e",
  "iat": 1790834400,
  "sub_id": {
    "format": "opaque",
    "id": "msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1"
  },
  "events": {
    "https://schemas.karlmcguinness.com/secevent/mission/lifecycle-change": {
      "mission": {
        "id": "msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1",
        "issuer": "https://as.example.com"
      },
      "state": "revoked",
      "prior_state": "active",
      "version": 2,
      "committed_at": "2026-09-30T23:00:00Z"
    }
  }
}
```

# 8. The check that stops the resume

At 02:00 the harness wakes to continue the draft and, before
dispatching anything, establishes current Mission state
([The Agent Runtime and Audit](/notes/mission-agent-runtime-and-audit/)).
The signed Status response says the one thing no credential in the
session can: the approved task no longer exists.

```json
{
  "iss": "https://as.example.com",
  "aud": "https://docs.example.com",
  "sub": "client_board-packet-agent",
  "nonce": "nonce_K9pV4nT2sR7mB1xQ",
  "iat": 1790845205,
  "exp": 1790845265,
  "mission": {
    "id": "msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1",
    "issuer": "https://as.example.com",
    "authority_hash":
      "sha-256:4hRwrGkW9Jdjbkj1oHJ3opg9HRvmRe30k7TQmUfiIpY",
    "state": "revoked",
    "expires_at": "2026-10-15T18:00:00Z",
    "fresh_until": "2026-10-01T02:01:05Z"
  }
}
```

The harness suppresses the resume and emits the
[evidence record](/notes/mission-agent-runtime-and-audit/#sessions-are-not-authority)
the agent runtime part shows. Session continuity was recoverable. The
authority was not, and the Mission, not the session, decided.

# Where each exhibit is normative

The [issuance core](https://mcguinness.github.io/mission-bound-authorization/#go.draft-mcguinness-oauth-mission.html)
owns exhibits 1 through 3 and the integrity anchors. The
[runtime profile](https://mcguinness.github.io/mission-bound-authorization/#go.draft-mcguinness-mission-runtime.html)
and its [AuthZEN binding](https://mcguinness.github.io/mission-bound-authorization/#go.draft-mcguinness-mission-authzen.html)
own 4 and 5. [Status and Lifecycle](https://mcguinness.github.io/mission-bound-authorization/#go.draft-mcguinness-oauth-mission-status.html)
owns 6 and 8, and [Lifecycle Signals](https://mcguinness.github.io/mission-bound-authorization/#go.draft-mcguinness-oauth-mission-signals.html)
owns 7. Where an exhibit and a draft disagree, the draft wins, and the
[Field Reference](/notes/mission-bound-authorization-reference/) is the
citable summary of the whole model.