Docs // authorization primitive
Agent Authorization Authority
They receipt the model call. We receipt everything the machine does.
Agent Authorization Authority
Ed25519
commit envelopes
offline-verifiable proof
local-only
CLI & HOOKS
repo never uploaded
Scroll Gate
PR enforcement
signed vs unsigned
SSX360
control plane
identity · billing · audit
Overview
NHI platforms discover identities. SSX360 produces portable, offline-verifiable proof of who authorized which agent to act — cryptographically signed, assessor-ready, without our platform in the trust path.
Compliance evidence packs (FS AI RMF, PCI, DORA) map procurement language to what you can prove offline — scoped in consultation, not a self-serve checkout.
Honest scope
Authorization ladder
What ships today versus what requires an Authorization Pilot engagement.
| Rung | Status | Surface |
|---|---|---|
| L1 Code | LIVE | Commits and releases — matrixscroll 0.6.0 |
| L2 Tools | LIVE | MCP manifests and tool surfaces — Trust Scanner |
| L3 Actions | 2026 | Agent runs and NHI authorization records |
| L4 Money | Seed | AP2 mandates and Vault Card — demo only in 2026; monetize on volume, no fixed date |
| L5 Silicon | 2029+ | Device attestation — SE050 PoC bench-validated Jul 2026, preview; OEM/partner optionality |
L2
MCP manifest baseline
Security teams blocking MCP need signed install-time baselines and drift detection.
pip install "matrixscroll==0.6.0" # Scan and sign MCP install-time baseline matrixscroll mcp scan --connect stdio --server-command "npx -y @modelcontextprotocol/server-filesystem ." \ -o baseline.json --pretty matrixscroll mcp sign baseline.json matrixscroll mcp verify baseline.json
Scanner: matrixscroll.com/scan
L3
Agent authorization record
What it proves
Portable Ed25519 envelopes bind actor, tool surface, and scope — verifiable without trusting SSX360.
matrixscroll sign-action --action-type agent_run \
--payload '{"tool":"mcp-filesystem","scope":"read"}'
matrixscroll verify-envelope envelope.jsonAssessor
Evidence pack export
Offline-verifiable JSON with compliance_mappings — your assessor verifies without uploading source code.
# Export authorization ledger + compliance mappings (signed in) ssx360 evidence export --format json
Public sample: evidence-pack-sample.json · schema docs
10 min
Demo path
- MCP scan → sign baseline → verify (unblock agents safely)
- sign_action envelope for an agent run
- Signed commit + Scroll Gate on a protected branch
- Authorization ledger view + evidence pack verify in browser
Consultation
Scope an Authorization Pilot
Authorization Pilot and enterprise engagements are scoped in consultation — no self-serve checkout.