FUURAA AI Civilization Architecture · Operating-layer engineering dossier
Identity: distinguish subject, credential and authority
A stable subject identifier is the beginning of an Agent decision, not permission to act. This dossier separates runtime subjects, real-world principals, authentication events, asserted attributes, delegated capabilities and accountable owners.
Public statusResearch direction · architecture referenceEvidence statusFUURAA method synthesis grounded in primary standardsSources checked19 August 2026
Core decision
Who or what is acting—and what exactly has been established about it?
Use this sequence for architecture review, threat modelling and test planning. It is not a universal compliance checklist and cannot replace system-specific engineering validation.
01
Resolve the runtime subject
Bind the exact Agent, service, device and release to a non-recycled identifier.
02
Name the principal
Record the person, organisation or service on whose behalf the subject requests action.
03
Separate assertions
Keep authentication strength, attributes, roles and credentials independently inspectable.
04
Bind delegated authority
Attach capability, scope, purpose, conditions, expiry and revocation to the delegation.
05
Record accountability
Preserve issuer, verifier, policy decision and accountable human or institution.
FUURAA analysisAgent identity should be decomposable. If one opaque token simultaneously means who acted, who authorised it, which attributes are true and what may be done, reviewers cannot locate the broken assumption. Stronger identity proofing does not repair excessive authority; the two decisions must remain separate and joined by evidence.
Minimum interface contracts
Put consequential semantics in inspectable interfaces instead of relying on assumptions between systems.
Field names are public engineering references, not a normative protocol. Implementations may use other structures, but should expose every lost, defaulted or downgraded semantic.
01
Subject contract
Must be intelligible to sender, receiver and independent reviewer.
Minimum fields
subject_id, subject_type and release
service/device identity and issuer
created, rotated and disabled state
Evidence gate
Logs distinguish a subject from its owner and from the principal it represents.
Stop condition
If the contract is unresolved, expired or silently downgraded, block consequential action and route to review.
02
Assertion contract
Must be intelligible to sender, receiver and independent reviewer.
Minimum fields
authentication event and assurance
attribute, issuer, audience and validity
verification result and uncertainty
Evidence gate
A consuming service can reject an assertion without losing the rest of the identity trail.
Stop condition
If the contract is unresolved, expired or silently downgraded, block consequential action and route to review.
03
Delegation contract
Must be intelligible to sender, receiver and independent reviewer.
Minimum fields
principal, capability and resource scope
purpose, approvals, expiry and revocation
policy version and decision trace
Evidence gate
Identity never silently expands into authority.
Stop condition
If the contract is unresolved, expired or silently downgraded, block consequential action and route to review.
Failures to seek deliberately
Verify that boundaries really deny, stop and preserve evidence.
Nominal success cannot establish an effective boundary. Tests should manipulate identity, time, version, network, policy and partial failure while retaining raw outcomes.
T1
Identifier collision
Recycle an old identifier and verify that prior authority cannot attach to the new subject.
T2
Stale assertion
Expire or revoke a credential during a long task and require a fresh decision.
T3
Principal confusion
Present valid identity for one principal while requesting another principal's resource.
T4
Issuer failure
Make issuer status unavailable and verify fail-closed behaviour for consequential action.
Minimum engineering evidence package
Let the next owner reproduce the decision, open artefacts and see remaining unknowns.
A complete package only makes evidence relationships reviewable; it does not prove artefacts authentic, controls effective, the system safe or the decision correct.
01
Subject registry snapshot
Versioned subject, type, release, owner and lifecycle state.
02
Authentication and assertion record
Issuer, method, assurance, audience, validity and verification result.
03
Delegation decision
Principal, scope, conditions, approval, expiry and revocation handle.
04
Negative tests
Collision, stale-credential, wrong-audience and confused-principal outcomes.
05
Ownership handoff
Named operator, exception route and accepted review responsibility.
Applicability boundary
This reference does not determine legal identity, electronic-signature validity, employment authority, guardianship, agency law or sector duties. It is not a claim that FUURAA products implement a credential or identity service.
Primary sources and evidence boundaries
Use standards language without presenting citations as implementation evidence.
Every source states publication timing, its role in this dossier and its non-transfer boundary; living source pages were checked 19 August 2026.
