Reference
Decision contract reference
What an IntentControl decision request carries, what a decision contains, the outcomes and their obligations, and the limits Core applies.
Release-gated · interface not public
Documented ahead of release. Commercially, IntentControl is coming soon in TrustOps and not yet on sale, and there is no public decision API: no endpoint, credential format or runtime is published here because none is available to integrators. Field names will be confirmed at release.
IntentControl today · measured 2026-10-10
- Commercial capability
- Coming soon · not yet on saleTrustOps lists every plan as coming soon. Nothing can be bought or provisioned yet.
- Signed-in operation
- Not yet availableThere is no signed-in operation until the service is confirmed live.
- Public developer interface
- Release-gatedThere is no public decision API, endpoint, credential format or SDK. Nothing is enforced by ECZ-ID.
- Contract
- Documented · release-gated contractDocumented ahead of release. Nothing is callable, and field names may change at release.
Accountability Chain:Decision
A decision request describes one proposed action
| Element | Content |
|---|---|
| Request identifier | Unique per request, 1–128 characters. The idempotency and replay key. |
| Actor | A Passport holder (child ECZ-ID) or an external identity: OIDC, SPIFFE, DID, OAuth client, X.509, API-key label or other |
| Intent reference | { intent_id, version }, or none |
| Action | Type and name (together the action key), resource, destination, parameters, amount, currency and data classes |
| Context | Whether it is a sandbox action; an approval reference when repeating an approved action |
| Enforcement | The mediation the point declares. Core uses the point’s registered mediation instead. |
A decision
| Element | Content |
|---|---|
| Decision identifier | Stable and derived from the organisation, the enforcement point and the request identifier |
| Outcome | One of five, below |
| Reason codes | At least one, for the final outcome only. Shown to the signed-in account holder; never public. |
| Checks | One row per dimension: scope, identity, trust state, Intent, authority, delegation, time, policy, action, resource, destination, parameters, financial, data class, rate, approval. Each passed, failed, not applicable, not evaluated or unavailable. |
| Intent and policy references | The Intent version and the policies that applied, with digests |
| Action | Type, name and a digest of the parameters. Parameters are never stored. |
| Validity | Evaluated at, and valid until 30 seconds later |
| Meaning | “ALLOW means every configured check passed for this one action. It is not a statement that the actor or the action is safe, legal, correct or certain to succeed.” |
| Enforcement guidance | Policy mode (enforce or monitor), fail mode (closed or open for low consequence), whether the action is high-consequence, and the registered mediation |
| Receipt digest | SHA-256 over the canonical decision. Unsigned: it identifies the decision and proves nothing to a third party. |
Outcomes
| Outcome | Obligation on the enforcement point |
|---|---|
| Allow | Run. It means the configured checks passed, nothing more. |
| Deny | Block. Never run. |
| Review | Hold. Do not run. Return the approval reference to the caller. |
| Indeterminate | Block, unless the low-consequence fail-open rule applies. |
| Unavailable | Block, unless the same rule applies. Never a statement about the action. |
Limits
| Limit | Value |
|---|---|
| Decision validity | 30 seconds |
| Local policy bundle validity and maximum staleness | 300 seconds |
| Mediation evidence freshness for enforced posture | 24 hours |
| Replay window | Current and previous UTC day |
| Approval lifetime | 24 hours, single use |
| Action parameters | 16,384 characters of JSON |
| Data classes per action | 32 |
Related
This page is explanation, not authority. Current state is only ever the live Resolver record. Live facts on this page were measured read-only on 2026-10-10.