Agent builders — drive a governed door

Your agent acts in a person's name. The door decides what that name is good for.

Only the specification is normative; this page is the walk in door order. The shape to internalize first: authority is a granted, scoped, revocable Mandate — a record, not an ambient permission — and everything below is the Mandate meeting a door.

1 · Discover

Fetch the site's discovery descriptor (GAA-SITE-1): the door endpoint, the verbs and scopes it accepts, the authority shapes it requires, its seal/verify endpoint, and its co-presence policy. Build against what the descriptor says, not against what a dashboard implies — the descriptor is the door's published shape.

2 · List what you may do — and read the answer as the grant

A governed door projects capability from the Mandate: what your agent sees offered is what its Principal's grant admits (C1, GAA-CTRL-1). An ungranted verb is not a greyed-out button — it is absent, and calling it is refused before it fires. Do not code around a refusal; a refusal is the system working, and it leaves a sealed record like any other decision.

3 · Act — and expect the hold on consequential verbs

Reading and rendering are informational; anything that moves money, sends, publishes, deletes, or binds the Principal is consequential. A consequential act gates on a human ratification the agent cannot self-produce (C3, GAA-CTRL-3): the agent proposes, a human disposes. Design your agent to hold and surface — propose the act, show the record, wait. An agent that treats the hold as latency to optimize away has misread the contract.

4 · Take the receipt — and verify it keyless

Every governed interaction emits a receipt: a typed, content-hashed artifact whose hash is sealed into a tamper-evident chain (GAA-REC-1). Verification needs no trust in you, the door, or the Institute: the receipt re-derives from the sealed record alone (GAA-REC-3), through the verify endpoint the descriptor named — a read-only GET, no key, no account. Hand the chain id to your Principal with the result; if a claim cannot be verified, present it as unproven (GAA-REC-4 makes the sim-until-real boundary explicit).

5 · Respect revocation

The Principal may revoke any grant at any time. Delegation is narrow-only (parent ∩ caveats) and revocation is centralized fresh-read: the decision point re-reads each ancestor's live Mandate on every action, so a revoked parent fails its whole delegation subtree closed on the next action (§4.4; delegation itself is GAA-COMP-1 — an agent MAY delegate a strictly-narrower slice to a sub-agent). Fresh-read the grant; never cache your way past a revocation.

Informative example

The walk above has been run against a live governed door by the founder's reference implementation — as a mechanism, with simulated counterparties, and honestly labeled as such. Nothing in this track requires that implementation: per GAA-CTRL-8, any conforming implementation MAY realize a control differently.