Platform Standards Enterprise Evidence Docs GitHub

Inspect the Evidence

Every claim on this page is public, versioned, and reproducible — code, tests, and reports are one click away.

Open Source Machine-Rerunnable draft-wei-aic-identity-cert-01 · draft-wei-aic-jwt-00

Named Security Claims

The core properties AIC is designed to guarantee, with the evidence that exercises them.

Claim	Status	Evidence
Delegation Integrity Every granted capability traces to a principal signature covering it.	Verified	Conformance vectors + end-to-end tests
Issuer / Principal Separation CA compromise alone cannot mint new principal authorization.	Verified	Design review + adversarial tests
Monotonic Delegation Effective capability only shrinks along a delegation chain.	Verified	Permission-matrix tests
Gateway Non-Expansion P_effective ⊆ P_principal ∩ C_agent ∩ P_gateway.	Verified	End-to-end permission matrix
Expiration After validity ends, ALLOW = false.	Verified	Validity + revocation tests
Replay Resistance Nonce uniqueness plus verifier-side tracking.	Verified	Anti-replay tests

Documented hardware (32 GB RAM, MariaDB persistence), rerunnable from the repository.

16k+ /s

Regular certificate issuance

8k+ /s

AIC certificate issuance

500k

Modeled concurrent agents

<0.5 ms

TLS handshake parsing overhead

An independently implemented EMILIA crossing profile reproduced 13/13 positive and adversarial cases; the joint conformance kit is being published.

Offline-verifiable, not zero-status. Authorization evidence verifies offline; certificate status may still consult CRL/OCSP.
Cryptographic attribution, not legal accountability. AIC proves who signed what — it does not assert legal responsibility.
One delegation hop today. The current interoperable profile limits chain depth; the data model supports more.
Replay resistance needs state. Nonce uniqueness works with verifier-side tracking, and that tracking is the measured cost.
Single-instance benchmarks. Measured feasibility on one machine — not a production-readiness claim.