Expand description
The ACT claim set.
Claims divide into two groups, and the split is deliberate.
Claims a verifier must enforce are typed: the temporal window, issuer and audience, the scope grant, the proof-of-possession binding required by ANVIL section 5.2, and the delegation constraints that make child capabilities a strict subset of their parent’s.
Claims only the issuer interprets - rate limits, spend budgets, device and
network bindings, audit trace - are carried in ActClaims::ext as opaque
CBOR. They travel inside the signature, so they cannot be stripped or
altered in transit, but this crate does not restate their schema. That
restatement is what produced the divergence this format replaces: three
copies of the claim structure, each drifting from the issuer.
Structs§
- ActClaims
- The claim set carried inside an ACT envelope.
- Confirmation
- Proof-of-possession binding.
- Delegation
- Constraints governing whether and how this token may be delegated onward.