From e60035c75b850de7a9c31b8af2971b478ca883d6 Mon Sep 17 00:00:00 2001 From: Christian Nennemann Date: Tue, 24 Feb 2026 19:21:54 +0100 Subject: [PATCH] Clarify that policy evaluation mechanics are out of scope Add paragraph in Policy Claims section explicitly stating that policy definition, distribution, and evaluation are out of scope. The pol claim is an opaque identifier; any policy engine may be used provided outcomes are faithfully recorded. Co-Authored-By: Claude Opus 4.6 --- ...-nennemann-wimse-execution-context-00.html | 9 + draft-nennemann-wimse-execution-context-00.md | 10 + ...t-nennemann-wimse-execution-context-00.txt | 50 +- ...t-nennemann-wimse-execution-context-00.xml | 1054 +++++++++-------- 4 files changed, 578 insertions(+), 545 deletions(-) diff --git a/draft-nennemann-wimse-execution-context-00.html b/draft-nennemann-wimse-execution-context-00.html index 6a28406..eb55c17 100644 --- a/draft-nennemann-wimse-execution-context-00.html +++ b/draft-nennemann-wimse-execution-context-00.html @@ -2276,6 +2276,15 @@ was made. When present, MUST be equal to or earlier
+

This specification intentionally defines only the recording of +policy evaluation outcomes. The mechanisms by which policies are +defined, distributed to agents, and evaluated are out of scope. +The "pol" claim is an opaque identifier referencing an external +policy; the semantics and enforcement of that policy are +determined by the deployment environment. Implementations may +use any policy engine or framework (e.g., OPA/Rego, Cedar, XACML, +or custom solutions) provided that the evaluation outcome is +faithfully recorded in the ECT claims defined above.ΒΆ

diff --git a/draft-nennemann-wimse-execution-context-00.md b/draft-nennemann-wimse-execution-context-00.md index 5f54b70..3fa98ae 100644 --- a/draft-nennemann-wimse-execution-context-00.md +++ b/draft-nennemann-wimse-execution-context-00.md @@ -538,6 +538,16 @@ pol_timestamp: was made. When present, MUST be equal to or earlier than the "iat" claim. +This specification intentionally defines only the recording of +policy evaluation outcomes. The mechanisms by which policies are +defined, distributed to agents, and evaluated are out of scope. +The "pol" claim is an opaque identifier referencing an external +policy; the semantics and enforcement of that policy are +determined by the deployment environment. Implementations may +use any policy engine or framework (e.g., OPA/Rego, Cedar, XACML, +or custom solutions) provided that the evaluation outcome is +faithfully recorded in the ECT claims defined above. + ### Data Integrity Claims {#data-integrity-claims} The following claims provide integrity verification for task diff --git a/draft-nennemann-wimse-execution-context-00.txt b/draft-nennemann-wimse-execution-context-00.txt index d4a5926..199e333 100644 --- a/draft-nennemann-wimse-execution-context-00.txt +++ b/draft-nennemann-wimse-execution-context-00.txt @@ -90,7 +90,7 @@ Table of Contents 4.2.1. WIMSE-Compatible Claims . . . . . . . . . . . . . . . 10 4.2.2. Execution Context Claims . . . . . . . . . . . . . . 11 4.2.3. Policy Claims . . . . . . . . . . . . . . . . . . . . 12 - 4.2.4. Data Integrity Claims . . . . . . . . . . . . . . . . 12 + 4.2.4. Data Integrity Claims . . . . . . . . . . . . . . . . 13 4.2.5. Operational Claims . . . . . . . . . . . . . . . . . 13 4.2.6. Witness Claims . . . . . . . . . . . . . . . . . . . 13 4.2.7. Compensation Claims . . . . . . . . . . . . . . . . . 14 @@ -660,12 +660,12 @@ Internet-Draft WIMSE Execution Context February 2026 decision was made. When present, MUST be equal to or earlier than the "iat" claim. -4.2.4. Data Integrity Claims - - The following claims provide integrity verification for task inputs - and outputs without revealing the data itself: - - inp_hash: OPTIONAL. String. A cryptographic hash of the input + This specification intentionally defines only the recording of policy + evaluation outcomes. The mechanisms by which policies are defined, + distributed to agents, and evaluated are out of scope. The "pol" + claim is an opaque identifier referencing an external policy; the + semantics and enforcement of that policy are determined by the + deployment environment. Implementations may use any policy engine or @@ -674,6 +674,16 @@ Nennemann Expires 28 August 2026 [Page 12] Internet-Draft WIMSE Execution Context February 2026 + framework (e.g., OPA/Rego, Cedar, XACML, or custom solutions) + provided that the evaluation outcome is faithfully recorded in the + ECT claims defined above. + +4.2.4. Data Integrity Claims + + The following claims provide integrity verification for task inputs + and outputs without revealing the data itself: + + inp_hash: OPTIONAL. String. A cryptographic hash of the input data, formatted as "hash-algorithm:base64url-encoded-hash" (e.g., "sha-256:n4bQgYhMfWWaL-qgxVrQFaO_TxsrC4Is0V1sFbDwCgg"). The hash algorithm identifier MUST be a lowercase value from the IANA Named @@ -712,6 +722,14 @@ Internet-Draft WIMSE Execution Context February 2026 third-party entities that the issuing agent claims observed or attested to the execution of this task. When present, each element SHOULD use SPIFFE ID format. Note that this claim is + + + +Nennemann Expires 28 August 2026 [Page 13] + +Internet-Draft WIMSE Execution Context February 2026 + + self-asserted by the ECT issuer; witnesses listed here do not co- sign this ECT. For stronger assurance, witnesses SHOULD submit independent signed ECTs to the ledger attesting to their @@ -721,15 +739,6 @@ Internet-Draft WIMSE Execution Context February 2026 See also Section 10.2 for the security implications of self- asserted witness claims. - - - - -Nennemann Expires 28 August 2026 [Page 13] - -Internet-Draft WIMSE Execution Context February 2026 - - 4.2.7. Compensation Claims compensation_required: OPTIONAL. Boolean. Indicates whether this @@ -772,15 +781,6 @@ Internet-Draft WIMSE Execution Context February 2026 - - - - - - - - - Nennemann Expires 28 August 2026 [Page 14] Internet-Draft WIMSE Execution Context February 2026 diff --git a/draft-nennemann-wimse-execution-context-00.xml b/draft-nennemann-wimse-execution-context-00.xml index b356336..9204ce2 100644 --- a/draft-nennemann-wimse-execution-context-00.xml +++ b/draft-nennemann-wimse-execution-context-00.xml @@ -570,6 +570,16 @@ was made. When present, MUST be equal to or earlier than the +This specification intentionally defines only the recording of +policy evaluation outcomes. The mechanisms by which policies are +defined, distributed to agents, and evaluated are out of scope. +The "pol" claim is an opaque identifier referencing an external +policy; the semantics and enforcement of that policy are +determined by the deployment environment. Implementations may +use any policy engine or framework (e.g., OPA/Rego, Cedar, XACML, +or custom solutions) provided that the evaluation outcome is +faithfully recorded in the ECT claims defined above. +
Data Integrity Claims @@ -2240,7 +2250,7 @@ been incorporated into this document. This document obsoletes RFC - +
Related Work @@ -2678,525 +2688,529 @@ tracing is built.