Actor identity
Authenticated principal and verified executable module identity, bound to an exact module digest.
TECHNOLOGY / PERMISSIONS
Explicit capabilities, not inherited privileges.
A capability represents a narrowly permitted operation, resource, actor and validity period that a trusted broker enforces.
Proposed capability record
Action and resource
Named operation on a specific resource, with tenant, object and data scopes.
Policy and lifetime
Versioned policy, issuance time, expiration, revocation and replay protection.
Human approval
Independently verified permission for sensitive changes, bound to the same action and resource.
Broker-level check
Resource host denies every operation not explicitly permitted; UI policy alone is insufficient.
Attributable evidence
Request correlation ID, identity, decision, result and bounded diagnostics.
Current proof point
The October 24, 2026 development record reports 20 local OSR 0.2 prototype tests, including allowed/denied filesystem access, revocation, expiry, replay, traversal/symlink checks and audit integrity. This does not certify protection against process escape or resource race conditions in production.