Authority & assurance · Concept

Capabilities with boundaries attached.

Each capability in Auditoracle is specified as a contract: scope, permission, evidence and failure behaviour.

Status Concept Category Authority & assurance Surfaces REST · MCP · CLI Contact [email protected]

The five contracts

Numbered for reference; the order is not a priority.

01. Continuous assurance monitoring

Specified with its own failure modes, limits and evidence requirements before it is exposed to an agent.

Scope is attached to the capability, not to the caller, so delegation does not widen it silently.

Surfaces REST · MCP · CLI

02. Evidence and trace examination

Defined as a scoped contract: the product states what it may touch, what it may change and what it must record.

The same capability is reachable from the application, the API and the agent surface without a second implementation.

Surfaces REST · MCP · CLI

03. Policy and conformance testing

Implemented through one permission model that applies to the human interface and the machine interface alike.

Scope is attached to the capability, not to the caller, so delegation does not widen it silently.

Surfaces REST · MCP · CLI

04. Audit findings and remediation

Implemented through one permission model that applies to the human interface and the machine interface alike.

Operators can inspect the capability before it runs and review its record afterwards.

Surfaces REST · MCP · CLI

05. Signed reports and verification APIs

Implemented through one permission model that applies to the human interface and the machine interface alike.

Scope is attached to the capability, not to the caller, so delegation does not widen it silently.

Surfaces REST · MCP · CLI

A capability in a specification is not a shipped feature.

Interfaces, permission model, evidence requirements, failure modes and the conformance checks a release must pass.

Running deployments, measured performance, third-party certifications or integration approvals.