The architecture series carries the argument, the Building Mission-Bound Authorization series carries the controls this appendix accompanies, and the Field Reference carries the definitions. This appendix carries the bytes: the running example, Alice’s Q3 board packet, as the protocol exhibits an implementer would actually see. Exhibits follow the draft family’s editor’s copies as of July 6, 2026, and the drafts are the normative text. Standard OAuth parameters that carry no Mission semantics are elided. Identifiers, keys, and digests are illustrative, with two exceptions: intent_hash and authority_hash reproduce byte for byte from the test vector, and the two parameter_digest values are real SHA-256 digests over the JCS form of the parameter objects shown.

1. The proposal: Mission Intent via PAR

The shaper turned Alice’s request into a candidate Mission Intent (From a Request to an Approved Mission), and the client submits it through a Pushed Authorization Request. The mission_intent parameter value is the UTF-8 JSON serialization of the Intent object, form-encoded on the wire. Decoded:

1
2
3
4
5
6
7
8
9

{
  "goal": "Prepare the Q3 board packet for the audit committee",
  "purpose": "urn:example:mission:board-packet",
  "resources": ["https://finance.example.com",
    "https://docs.example.com",
    "https://workflow.example.com"],
  "constraints": ["Q3 2026", "Example Corp", "confidential"],
  "expires_at": "2026-10-15T18:00:00Z"
}

The client never sends authorization_details alongside mission_intent. It proposes a task. The Authorization Server derives the authority.

2. The pivot: the approved record

The Authorization Server validates the Intent, derives the Authority Set (query_financials, create_doc, notify_reviewer), renders the disclosure, and on Alice’s approval commits the Mission atomically. The concrete record lives in the Reference. The two anchors it commits are the ones every later exhibit carries:

AnchorValue
intent_hashsha-256:jjx06KDh_TpWYhzSAvzEBH_lMz32eRj1tjgjNvt-crE
authority_hashsha-256:4hRwrGkW9Jdjbkj1oHJ3opg9HRvmRe30k7TQmUfiIpY

3. The projection: a Mission-bound token

The agent asks for authority to read the financials. Issuance is a derivation, gated on the Mission being active, and the response echoes the narrowed grant and the mission_id reference:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

{
  "access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImF0K2p3dCJ9...",
  "token_type": "DPoP",
  "expires_in": 300,
  "mission_id": "msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1",
  "authorization_details": [
    { "type": "mission_resource_access",
      "resource": "https://finance.example.com",
      "actions": ["query_financials"],
      "constraints": { "period": "Q3 2026" } }
  ]
}

The decoded access-token claims carry the projection: a subset of the Authority Set, a sender-constraint key, and the mission claim that binds the credential back to the governance record. The token’s exp is minutes away. The Mission’s expires_at is weeks away. That asymmetry is the Durability law.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

{
  "iss": "https://as.example.com",
  "sub": "alice@example.com",
  "aud": "https://finance.example.com",
  "client_id": "s6BhdRkqt3",
  "iat": 1790812980,
  "exp": 1790813280,
  "jti": "at_3Vq8nK2xT6mR9sY1pZ4d",
  "authorization_details": [
    { "type": "mission_resource_access",
      "resource": "https://finance.example.com",
      "actions": ["query_financials"],
      "constraints": { "period": "Q3 2026" } }
  ],
  "cnf": { "jkt": "0ZcOCORZNYy-DWpqq30jZyJGHTN0d2HglBV3uiguA4I" },
  "mission": {
    "id": "msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1",
    "issuer": "https://as.example.com",
    "authority_hash":
      "sha-256:4hRwrGkW9Jdjbkj1oHJ3opg9HRvmRe30k7TQmUfiIpY"
  }
}

4. The gate: an AuthZEN permit, bound to parameters

The packet is drafted and the agent notifies the audit committee. The notify is externally visible, so the PEP at workflow.example.com asks the PDP before acting (Mission-Bound Runtime Enforcement, AuthZEN binding). The Mission, actor, parameters, and freshness ride in context:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

{
  "subject": {
    "type": "user",
    "id": "alice@example.com",
    "properties": { "iss": "https://login.example.com" }
  },
  "resource": {
    "type": "notification",
    "id": "notif_board_packet_q3"
  },
  "action": { "name": "notify_reviewer" },
  "context": {
    "mission": {
      "id": "msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1",
      "issuer": "https://as.example.com",
      "authority_hash":
        "sha-256:4hRwrGkW9Jdjbkj1oHJ3opg9HRvmRe30k7TQmUfiIpY",
      "state": "active",
      "policy_version": "deploy-policy:v17"
    },
    "actor": { "client_id": "s6BhdRkqt3" },
    "parameters": {
      "group": "audit-committee",
      "message": "Q3 board packet is ready for review"
    },
    "parameter_digest":
      "sha-256:DCTAlrBUhQwW_t1EDxHCjdNkLbrT_Bc6nCLYkQubRU4",
    "audience": "https://workflow.example.com"
  }
}

The permit comes back bound to exactly those parameters, with a single-use decision identifier because the action is externally visible:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

{
  "decision": true,
  "context": {
    "decision_id": "dec_2FpQ8kV5nR1tX7mB4sJ9eL6wYc",
    "action_class": "external_commitment",
    "class_source": "deployment",
    "parameter_digest":
      "sha-256:DCTAlrBUhQwW_t1EDxHCjdNkLbrT_Bc6nCLYkQubRU4",
    "permit_expires_at": "2026-09-30T18:06:00Z",
    "single_use": true
  }
}

The executing PEP recomputes the digest against the parameters it is about to use. Change the message after the permit and the digest mismatches. That is the TOCTOU gap, closed.

5. The refusal: parameter_violation

Steered by a prompt-injected document, the agent tries the same notify against a different audience. The Authority Set’s constraint names audit-committee, so the evaluation succeeds and the decision is no:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

{
  "decision": false,
  "context": {
    "decision_id": "dec_6JwN3xT9rQ4mV8kP1sB5eZ2yLd",
    "denial_reason": "parameter_violation",
    "action_class": "external_commitment",
    "class_source": "deployment",
    "parameter_digest":
      "sha-256:_0sG_Vm6EFHvqL5MMNYp-iL1KXXW5CGMr3NLXcXbKrc"
  }
}

A denial is a successful evaluation, not a transport error, and it lands in the evidence trail with the same decision_id discipline as a permit.

6. The stop: revocation by mission_id

At 23:00 the board meeting is cancelled and an administrator ends the task at the lifecycle endpoint (Mission Lifecycle and Change). One authenticated call, keyed by the Mission, touching no token:

1
2
3
4
5
6
7
8
9

POST /as/mission/lifecycle HTTP/1.1
Host: as.example.com
Content-Type: application/x-www-form-urlencoded
Authorization: DPoP eyJhbGciOiJFUzI1NiIsImtpZCI6...

mission=msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1
&operation=revoke
&reason=Board+meeting+cancelled
&nonce=nonce_8Y3vN0sM6tP1xR9bQ5

7. The announcement: a lifecycle event

Subscribed consumers learn the transition through the experimental Signals push, a Security Event Token whose strictly monotonic version makes replayed or reordered events harmless. Decoded:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

{
  "iss": "https://as.example.com",
  "jti": "set_5R8wQ2kN7mX4vT1pB6zJ3e",
  "iat": 1790834400,
  "sub_id": {
    "format": "opaque",
    "id": "msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1"
  },
  "events": {
    "https://schemas.karlmcguinness.com/secevent/mission/lifecycle-change": {
      "mission": {
        "id": "msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1",
        "issuer": "https://as.example.com"
      },
      "state": "revoked",
      "prior_state": "active",
      "version": 2,
      "committed_at": "2026-09-30T23:00:00Z"
    }
  }
}

8. The check that stops the resume

At 02:00 the harness wakes to continue the draft and, before dispatching anything, establishes current Mission state (The Agent Runtime and Audit). The signed Status response says the one thing no credential in the session can: the approved task no longer exists.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

{
  "iss": "https://as.example.com",
  "aud": "https://docs.example.com",
  "sub": "client_board-packet-agent",
  "nonce": "nonce_K9pV4nT2sR7mB1xQ",
  "iat": 1790845205,
  "exp": 1790845265,
  "mission": {
    "id": "msn_01J9Z2P8BQ4Y3F0V0K9D6Z7M1",
    "issuer": "https://as.example.com",
    "authority_hash":
      "sha-256:4hRwrGkW9Jdjbkj1oHJ3opg9HRvmRe30k7TQmUfiIpY",
    "state": "revoked",
    "expires_at": "2026-10-15T18:00:00Z",
    "fresh_until": "2026-10-01T02:01:05Z"
  }
}

The harness suppresses the resume and emits the evidence record the agent runtime part shows. Session continuity was recoverable. The authority was not, and the Mission, not the session, decided.

Where each exhibit is normative

The issuance core owns exhibits 1 through 3 and the integrity anchors. The runtime profile and its AuthZEN binding own 4 and 5. Status and Lifecycle owns 6 and 8, and Lifecycle Signals owns 7. Where an exhibit and a draft disagree, the draft wins, and the Field Reference is the citable summary of the whole model.