diff --git a/draft-nennemann-wimse-execution-context-00.html b/draft-nennemann-wimse-execution-context-00.html
index 6a28406..eb55c17 100644
--- a/draft-nennemann-wimse-execution-context-00.html
+++ b/draft-nennemann-wimse-execution-context-00.html
@@ -2276,6 +2276,15 @@ was made. When present, MUST be equal to or earlier
+This specification intentionally defines only the recording of
+policy evaluation outcomes. The mechanisms by which policies are
+defined, distributed to agents, and evaluated are out of scope.
+The "pol" claim is an opaque identifier referencing an external
+policy; the semantics and enforcement of that policy are
+determined by the deployment environment. Implementations may
+use any policy engine or framework (e.g., OPA/Rego, Cedar, XACML,
+or custom solutions) provided that the evaluation outcome is
+faithfully recorded in the ECT claims defined above.ΒΆ
diff --git a/draft-nennemann-wimse-execution-context-00.md b/draft-nennemann-wimse-execution-context-00.md
index 5f54b70..3fa98ae 100644
--- a/draft-nennemann-wimse-execution-context-00.md
+++ b/draft-nennemann-wimse-execution-context-00.md
@@ -538,6 +538,16 @@ pol_timestamp:
was made. When present, MUST be equal to or earlier than the
"iat" claim.
+This specification intentionally defines only the recording of
+policy evaluation outcomes. The mechanisms by which policies are
+defined, distributed to agents, and evaluated are out of scope.
+The "pol" claim is an opaque identifier referencing an external
+policy; the semantics and enforcement of that policy are
+determined by the deployment environment. Implementations may
+use any policy engine or framework (e.g., OPA/Rego, Cedar, XACML,
+or custom solutions) provided that the evaluation outcome is
+faithfully recorded in the ECT claims defined above.
+
### Data Integrity Claims {#data-integrity-claims}
The following claims provide integrity verification for task
diff --git a/draft-nennemann-wimse-execution-context-00.txt b/draft-nennemann-wimse-execution-context-00.txt
index d4a5926..199e333 100644
--- a/draft-nennemann-wimse-execution-context-00.txt
+++ b/draft-nennemann-wimse-execution-context-00.txt
@@ -90,7 +90,7 @@ Table of Contents
4.2.1. WIMSE-Compatible Claims . . . . . . . . . . . . . . . 10
4.2.2. Execution Context Claims . . . . . . . . . . . . . . 11
4.2.3. Policy Claims . . . . . . . . . . . . . . . . . . . . 12
- 4.2.4. Data Integrity Claims . . . . . . . . . . . . . . . . 12
+ 4.2.4. Data Integrity Claims . . . . . . . . . . . . . . . . 13
4.2.5. Operational Claims . . . . . . . . . . . . . . . . . 13
4.2.6. Witness Claims . . . . . . . . . . . . . . . . . . . 13
4.2.7. Compensation Claims . . . . . . . . . . . . . . . . . 14
@@ -660,12 +660,12 @@ Internet-Draft WIMSE Execution Context February 2026
decision was made. When present, MUST be equal to or earlier than
the "iat" claim.
-4.2.4. Data Integrity Claims
-
- The following claims provide integrity verification for task inputs
- and outputs without revealing the data itself:
-
- inp_hash: OPTIONAL. String. A cryptographic hash of the input
+ This specification intentionally defines only the recording of policy
+ evaluation outcomes. The mechanisms by which policies are defined,
+ distributed to agents, and evaluated are out of scope. The "pol"
+ claim is an opaque identifier referencing an external policy; the
+ semantics and enforcement of that policy are determined by the
+ deployment environment. Implementations may use any policy engine or
@@ -674,6 +674,16 @@ Nennemann Expires 28 August 2026 [Page 12]
Internet-Draft WIMSE Execution Context February 2026
+ framework (e.g., OPA/Rego, Cedar, XACML, or custom solutions)
+ provided that the evaluation outcome is faithfully recorded in the
+ ECT claims defined above.
+
+4.2.4. Data Integrity Claims
+
+ The following claims provide integrity verification for task inputs
+ and outputs without revealing the data itself:
+
+ inp_hash: OPTIONAL. String. A cryptographic hash of the input
data, formatted as "hash-algorithm:base64url-encoded-hash" (e.g.,
"sha-256:n4bQgYhMfWWaL-qgxVrQFaO_TxsrC4Is0V1sFbDwCgg"). The hash
algorithm identifier MUST be a lowercase value from the IANA Named
@@ -712,6 +722,14 @@ Internet-Draft WIMSE Execution Context February 2026
third-party entities that the issuing agent claims observed or
attested to the execution of this task. When present, each
element SHOULD use SPIFFE ID format. Note that this claim is
+
+
+
+Nennemann Expires 28 August 2026 [Page 13]
+
+Internet-Draft WIMSE Execution Context February 2026
+
+
self-asserted by the ECT issuer; witnesses listed here do not co-
sign this ECT. For stronger assurance, witnesses SHOULD submit
independent signed ECTs to the ledger attesting to their
@@ -721,15 +739,6 @@ Internet-Draft WIMSE Execution Context February 2026
See also Section 10.2 for the security implications of self-
asserted witness claims.
-
-
-
-
-Nennemann Expires 28 August 2026 [Page 13]
-
-Internet-Draft WIMSE Execution Context February 2026
-
-
4.2.7. Compensation Claims
compensation_required: OPTIONAL. Boolean. Indicates whether this
@@ -772,15 +781,6 @@ Internet-Draft WIMSE Execution Context February 2026
-
-
-
-
-
-
-
-
-
Nennemann Expires 28 August 2026 [Page 14]
Internet-Draft WIMSE Execution Context February 2026
diff --git a/draft-nennemann-wimse-execution-context-00.xml b/draft-nennemann-wimse-execution-context-00.xml
index b356336..9204ce2 100644
--- a/draft-nennemann-wimse-execution-context-00.xml
+++ b/draft-nennemann-wimse-execution-context-00.xml
@@ -570,6 +570,16 @@ was made. When present, MUST be equal to or earlier than the
+This specification intentionally defines only the recording of
+policy evaluation outcomes. The mechanisms by which policies are
+defined, distributed to agents, and evaluated are out of scope.
+The "pol" claim is an opaque identifier referencing an external
+policy; the semantics and enforcement of that policy are
+determined by the deployment environment. Implementations may
+use any policy engine or framework (e.g., OPA/Rego, Cedar, XACML,
+or custom solutions) provided that the evaluation outcome is
+faithfully recorded in the ECT claims defined above.
+
Data Integrity Claims
@@ -2240,7 +2250,7 @@ been incorporated into this document. This document obsoletes RFC
-
+
Related Work
@@ -2678,525 +2688,529 @@ tracing is built.