{"$defs":{"aat_record":{"additionalProperties":false,"allOf":[{"if":{"properties":{"signature":{"type":"string"}},"required":["signature"]},"then":{"required":["signer_kid"]}},{"if":{"properties":{"outcome":{"const":"denied"}},"required":["outcome"]},"then":{"required":["deny_reasons"]}}],"description":"Field constraints (draft §3.3): a record SHOULD NOT exceed 64 KB serialised (guidance level); validators MUST reject records over 256 KB (262144 bytes of canonical serialisation) — the single rejection threshold, enforced at runtime by the Lab verifier.","not":{"anyOf":[{"required":["external_timestamp"]},{"required":["batch"]}]},"properties":{"action_detail":{"type":"object"},"action_type":{"enum":["tool_call","tool_response","decision","delegation","escalation","error","lifecycle"],"type":"string"},"agent_id":{"format":"uri","type":"string"},"agent_version":{"type":"string"},"content_fingerprint":{"description":"SHA-256 of the full action content computed before redaction, over the JCS canonical serialisation.","pattern":"^[0-9a-f]{64}$","type":"string"},"cost_estimate":{"$ref":"#/$defs/cost_estimate","description":"Required on every cost-bearing record in the Lab profile."},"deny_reasons":{"description":"Required when outcome is denied. Draft codes are used verbatim; Lab-specific codes carry the THRESWARDA_ prefix.","items":{"type":"string"},"type":"array"},"human_override":{"additionalProperties":false,"description":"Required when a human intervenes (an approval, denial, or override).","properties":{"operator_id":{"type":"string"},"original_action":{"type":"string"},"reason":{"type":"string"}},"required":["operator_id","reason","original_action"],"type":"object"},"input_hash":{"pattern":"^[0-9a-f]{64}$","type":"string"},"latency_ms":{"minimum":0,"type":"number"},"model_id":{"description":"Required for Lab scenario records: deterministic scenarios name the evaluator they ran.","type":"string"},"nonce":{"description":"At least 128 bits of entropy, lowercase hex. Required in the Lab profile.","pattern":"^[0-9a-f]{32,}$","type":"string"},"outcome":{"enum":["success","failure","timeout","denied","escalated"],"type":"string"},"output_hash":{"pattern":"^[0-9a-f]{64}$","type":"string"},"parent_record_id":{"type":["string","null"]},"prev_hash":{"description":"SHA-256 of the previous record's canonical JSON (RFC 8785 JCS), lowercase hex. The Lab profile's hash input excludes the signature envelope (signature, signer_kid, sig_alg) and any detached batch field; the envelope is bound instead by the verifier, which derives the RFC 7638 thumbprint of the trusted public key and requires it to equal signer_kid, and pins sig_alg to ES256.","pattern":"^[0-9a-f]{64}$","type":["string","null"]},"principal":{"$ref":"#/$defs/principal"},"record_id":{"format":"uuid","type":"string"},"record_phase":{"enum":["pre_execution","post_execution","concurrent"],"type":"string"},"sequence_number":{"description":"Monotonic, gap-free, 0 at genesis. Present on all Lab records (the draft's all-or-none rule, adopted by always including it).","minimum":0,"type":"integer"},"session_id":{"format":"uuid","type":"string"},"sig_alg":{"default":"ES256","enum":["ES256","ML-DSA-65","Ed25519"],"type":"string"},"signature":{"description":"ES256 (ECDSA P-256) over the record's canonical JSON excluding the signature envelope (signature, signer_kid, sig_alg) itself and any detached batch field, Base64url. Required on Lab records.","type":"string"},"signer_kid":{"description":"RFC 7638 JWK SHA-256 thumbprint, Base64url without padding. Mandatory whenever signature is present.","type":"string"},"timestamp":{"description":"RFC 3339 with mandatory UTC offset; millisecond precision used.","format":"date-time","type":"string"},"trust_level":{"enum":["L0","L1","L2","L3","L4"],"type":"string"}},"required":["record_id","timestamp","agent_id","principal","agent_version","session_id","action_type","action_detail","outcome","trust_level","parent_record_id","prev_hash","record_phase","sequence_number","nonce"],"type":"object"},"ceiling":{"additionalProperties":false,"properties":{"response":{"description":"alert is notify-only: the ceiling reports alerted_only and execution continues. Alerting is not enforcement.","enum":["enforce","alert"],"type":"string"},"value":{"description":"Null is a declared absence (with the reason recorded in the scenario fixture), never an omission.","type":["number","null"]}},"required":["value","response"],"type":"object"},"cost_estimate":{"additionalProperties":false,"properties":{"amount":{"minimum":0,"type":"number"},"breakdown":{"properties":{"api_calls":{"type":"number"},"compute":{"type":"number"},"tokens":{"type":"number"}},"type":"object"},"currency":{"pattern":"^[A-Z]{3}$","type":"string"}},"required":["amount","currency"],"type":"object"},"principal":{"additionalProperties":false,"properties":{"authority_ref":{"description":"An authorization_record_id, the record_id of a delegation record, or an external grant identifier. MUST be null where no explicit authorisation artefact exists; the basis of authority is then documented in action_detail.","type":["string","null"]},"principal_id":{"description":"For natural persons, pseudonymous or role-based per draft §12.","format":"uri","type":"string"},"principal_type":{"enum":["human","organization","service","agent"],"type":"string"}},"required":["principal_type","principal_id","authority_ref"],"type":"object"},"refund_authority_policy":{"additionalProperties":false,"properties":{"ceilings":{"additionalProperties":false,"properties":{"max_cumulative_refund_usd":{"$ref":"#/$defs/ceiling"},"max_loop_cost_usd":{"$ref":"#/$defs/ceiling"},"max_steps":{"$ref":"#/$defs/ceiling"},"max_wall_clock_min":{"$ref":"#/$defs/ceiling"}},"required":["max_loop_cost_usd","max_cumulative_refund_usd","max_steps","max_wall_clock_min"],"type":"object"},"enforcement":{"additionalProperties":false,"properties":{"enforce_approval":{"type":"boolean"},"enforce_authority_chain":{"type":"boolean"},"enforce_grant_expiry":{"type":"boolean"},"nonce_check":{"type":"boolean"}},"required":["nonce_check","enforce_authority_chain","enforce_approval","enforce_grant_expiry"],"type":"object"},"grants":{"items":{"additionalProperties":false,"properties":{"delegated_by":{"type":"string"},"grant_id":{"type":"string"},"principal":{"type":"string"},"scope":{"items":{"type":"string"},"type":"array"},"valid_until":{"format":"date-time","type":"string"}},"required":["grant_id","principal","scope","valid_until"],"type":"object"},"type":"array"},"limits":{"additionalProperties":false,"properties":{"approval_threshold_usd":{"minimum":0,"type":"number"},"high_value_threshold_usd":{"minimum":0,"type":"number"},"per_action_usd":{"additionalProperties":{"exclusiveMinimum":0,"type":"number"},"type":"object"}},"required":["per_action_usd","approval_threshold_usd","high_value_threshold_usd"],"type":"object"},"policy_id":{"type":"string"},"policy_version":{"type":"string"},"schema_version":{"type":"string"},"tools":{"items":{"type":"string"},"type":"array"},"workflow_family":{"const":"refund-issuance","type":"string"}},"required":["policy_id","policy_version","schema_version","workflow_family","tools","grants","limits","ceilings","enforcement"],"type":"object"}},"$id":"https://threswarda.com/policy/policy-schema.json","$schema":"https://json-schema.org/draft/2020-12/schema","description":"The record schema implements the -09 mandatory core (13 fields, including the mandatory principal object) plus the Lab profile's mandatory subset of draft-optional fields. The draft is an individual Internet-Draft, work in progress, not an IETF standard. Profile revision pinned: draft-sharif-agent-audit-trail-09 (dated 26 Oct 2026, expires 29 Apr 2027), last_verified_at 2026-10-28.","properties":{"aat_record":{"$ref":"#/$defs/aat_record"},"refund_authority_policy":{"$ref":"#/$defs/refund_authority_policy"}},"title":"Threswarda canonical policy schema — AAT record profile (draft-sharif-agent-audit-trail-09) + Lab refund-authority policy object","type":"object"}