Name the action class before deciding whether the agent can execute.
Method + open protocol profile
Trust Graduation.
Agents earn bounded authority from verified behavior—not confidence, prompt instructions, or blanket tool access.
Mission Control is the reference approval interface. Mission Gate is the cross-runtime authority layer. The method stays neutral across OpenAI Agents SDK, MCP, and future agent runtimes.
Why it exists
Binary agent permission is too crude.
A useful agent may be safe to summarize, rank, or draft long before it should send email, post publicly, spend money, mutate production state, or make legal commitments.
Use receipts, approvals, reversibility, and past outcomes as permission evidence.
Let agents produce local packets and drafts without creating external consequences.
Every approval or refusal becomes a receipt and a trust delta.
Public permission ladder
Use simple words for a serious governance problem.
Observe
Read, search, inspect, summarize, and rank. No external effect.
Draft
Create a local draft, option set, or response candidate for a person to shape.
Prepare
Package evidence, risk, exact action, and external_actions: 0 before review.
Execute with approval
Send, post, commit, schedule, or mutate state only after a human approves.
Autonomous within bounds
Repeat proven, reversible actions inside clear limits after receipts show earned trust.
Weekly governance artifact
Mission Risk Report.
Each workspace should be able to show what agents prepared, what humans approved, what Mission blocked, what was corrected, and what the system learned. That is the operational bridge between agent productivity and enterprise trust.
For buyersWorkflow redesign, enterprise value, governance, and scaling agents safely.
For buildersTeach, test, share, collect feedback, and improve continuously.
For reviewersReceipts make trust inspectable before autonomy expands.
Public pageRead the weekly Mission Risk Report format.
Canonical vocabulary
Four objects make delegated authority portable.
Action, grant, decision, and receipt create one verifiable chain across runtimes. Mission publishes the schema package and conformance fixtures; independent adoption is the test of portability.
ActionThe typed capability, actor, target, payload digest, policy digest, tenant, and trace.
GrantThe narrow authority scope, exact input, expiry, revocation state, and use bound.
DecisionThe human or policy judgment tied to that action and grant.
ReceiptThe signed execution and provider-result claim, independently verifiable outside Mission.
Canonical package
npm install @trust-graduation/core embeds the zero-dependency reference implementation.Agent-native contract
Denied should still be useful.
An agent should not only hear no. It should receive the next safe move: prepare an approval packet, collect receipt-backed evidence, reduce scope to a draft, run a dry run, or stop.
Discovery
/.well-known/trust-graduation tells agents where the protocol, schemas, and supported action classes live.Agent contract
/agent-contract.json shows the request/response shape for permission decisions.Graduation pathReview or denial responses can include
graduationPath.next_best_action, so the agent has a compliant path forward.No route-around
blocked and human_only require stop or scope reduction, not another tool or prompt.Approval packet
Preparing work is not executing it.
An approval packet should make the action legible before anything leaves the workspace.
Action classWhat kind of consequence is this?
Proposed actionWhat exactly will happen if approved?
EvidenceWhat receipts or prior outcomes support this?
External actionsZero until a human approves execution.
Receipt previewWhat will be recorded after approve, reject, or revise?
Builder critique
Where should this layer live?
Inside each app, inside MCP, inside evals, or as a separate receipt-based permission layer? That is the question we are testing with builders now.