Struct CredentialSubject 

pub struct CredentialSubject {
    pub human_principal: HumanPrincipalRef,
    pub agent: AgentRef,
    pub channel: ChannelDescriptor,
    pub communication: CommunicationDescriptor,
    pub policy: PolicyDescriptor,
    pub notarization: NotarizationMetadata,
    pub apple_aur_acceptance: Option<AppleAurAcceptanceClaim>,
    pub audience: Option<Audience>,
    pub sealed_payload: Option<SealedPayload>,
    pub act_classification: Option<ActClassification>,
}

The notarized claim: who authorized what, on which channel, under which policy, attested by which notary.

Fields

human_principal: HumanPrincipalRef

The human on whose behalf the agent acted.

agent: AgentRef

The agent that produced the communication.

channel: ChannelDescriptor

Delivery channel and recipient addressing.

communication: CommunicationDescriptor

What was sent: content class, body hash, size, preview.

policy: PolicyDescriptor

The authorization decision and the scope it matched.

notarization: NotarizationMetadata

Which notary decided, when, and how long it took.

apple_aur_acceptance: Option<AppleAurAcceptanceClaim>

Last-position additive field. Optional Apple Foundation Models AUR acceptance claim per (user_id, device_id, aur_version_hash). #[serde(default, skip_serializing_if = "Option::is_none")] preserves wire back-compat (legacy envelopes omit the field and continue to deserialize cleanly).

audience: Option<Audience>

Who may accept this envelope (RFC 0003 §1). OPTIONAL, omitted when absent: an envelope without it is byte-identical to one written before the field existed, every signature over those bytes stays valid, and absence is the producer’s DECISION to issue a bearer credential rather than an oversight the verifier forgives.

⚠ EMITTING THIS IS VERSION-GATED for the same structural reason as act_classification below: every wire struct here carries deny_unknown_fields, so a pre-RFC-0003 verifier fails an envelope carrying this at STRICT PARSE. A producer MUST NOT emit it until it has reason to believe the recipient understands it (§10.1).

sealed_payload: Option<SealedPayload>

A payload only its named reader can open (spec/aph-0.2.md, RFC 0008). OPTIONAL, omitted when absent — and DECLARED ONLY FROM aphVersion 0.2: sealed_payload_is_declared is the rule’s teeth, and a v0.1.0 verifier refuses the member at strict parse, correctly. ⚠ EMITTING is version-gated like every optional sibling here (§10.1).

act_classification: Option<ActClassification>

Last-position additive field. What the sender says this act MEANS, in terms of one or more independently published vocabularies (RFC 0006).

Omitted when absent, so an envelope making no such claim is byte-identical to one written before the field existed and every signature over those bytes stays valid.

⚠ EMITTING THIS IS VERSION-GATED, and the reason is structural rather than stylistic: every wire struct in this module carries deny_unknown_fields, so a verifier built before this field existed does not ignore it — it fails at STRICT PARSE, below the protocol’s own error vocabulary. A producer MUST NOT emit this until it has reason to believe the recipient understands it; the AgentCard extension declaration (§10.1) is the existing mechanism for forming that belief. Adding the field to this type is safe for everyone. Putting it on the wire is not, and that asymmetry is the whole of the rule.

Trait Implementations

impl Clone for CredentialSubject

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CredentialSubject

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CredentialSubject

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for CredentialSubject

impl PartialEq for CredentialSubject

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for CredentialSubject

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for CredentialSubject