Deprecated alias of POST /v1/authority/grants: the same handler, kept registered so AgentSafe 0.3.8, the Go govern client and installed SDKs keep working byte-for-byte. Removal is a later, separate decision.

Agent-Safe enforcement route. Decionis recomputes the SHA-256 hash of the canonical execution intent, evaluates policy in ENFORCEMENT mode, and issues a short-lived Ed25519 execution grant only for an ALLOW evaluated in ENFORCEMENT mode. SHADOW records the same exact intent and dossier evidence without issuing an execution grant. When Idempotency-Key is supplied, it must exactly match the intent_id embedded in the signed intent; intent_id is the grant issuance boundary. ESCALATE, REVIEW_REQUIRED, BLOCK, dependency errors, and binding errors never receive a grant. A Presence approval is accepted only after Decionis verifies the action-bound request and sealed receipt directly with Presence; approval then becomes evidence for a fresh policy evaluation, not authority by itself. A presence attestation (evidence.humanApproval.provider attestation) is a presence provider's compact JWS, typ decionis-presence-attestation+jwt, verified against a key the organisation registered at /v1/execution/provider-keys with purpose presence_attestation (see PresenceAttestationClaims). On success its facts are written to agent_safe.human_approval (provider, verified, method, approver_role, subject, attestation_id, key_id, approved_action_digest, approved_at, expires_at, and token_match / network_validated when the provider sent them) for policy rules to match, and the resulting ExecutionBinding records the attested approval. An ESCALATE becomes an ALLOW only when the organisation's policy has a rule matching those facts. A refused attestation is a 409 with one of the PresenceAttestationRefusal codes, and no evaluation runs. A signed producer signal (evidence.signals[].token) is a producer's compact JWS, typ decionis-signed-signal+jwt, standing for up to thirty days and bound to no intent: a cardholder's delegation to an agent, say (see SignedSignalClaims). Each is verified before any evaluation against a key the organisation registered at /v1/execution/provider-keys with purpose signed_signal, or against the JWKS of an admitted presence provider, and its facts are written to agent_safe.signed_signals.<name> (verified, producer, method, subject, signal_id, key_id, issued_at, expires_at, evidence_digest, what it asserted, and covers / covers_intent: what of this intent it covers). A policy names the fact with required_signals as a dotted path (agent_safe.signed_signals.card_delegation) and decides with rules; the ExecutionBinding records the facts, and the claim rebuilds them and re-checks the key and the expiry. Signals may come with or without a human approval, in any mode, and beside a managed escalation. A refused signal is a 409 with one of the SignedSignalRefusal codes; no evaluation runs and no event fires. The token itself is never recorded, only its SHA-256 as evidence_digest. An ESCALATE in ENFORCEMENT, direct or managed, is queued to the organisation's event subscribers as authority.escalation_required, carrying the policy's selector and who proves the person (the verification block: provider, methods, level); and once the intent is presented again with human approval evidence, the answer is queued as authority.escalation_resolved (the fresh decision's outcome, or REFUSED with the refusal code), with the proof's facts and never the proof. Delivery never affects a decision. The same routing rides on an ESCALATE decision as escalation_requirement for the runtime from agent-safe-pipeline/0.3.7 on, and for no other client. When escalation.mode is MANAGED and policy returns ESCALATE, Decionis persists the original exact intent and orchestrates the policy-issued Presence ceremony. The response remains non-authorizing and carries a managed_escalation status locator; no ExecutionBinding or execution token exists until signed Presence evidence is independently verified and current policy is evaluated again. The decision carries the dossier's verification envelope (the same share-safe page evaluate-decision attaches) for a client that can read it: one identifying itself as agent-safe-pipeline/0.2.0 or later, or as govern/2.0.0 or later (the workflow gate), in its User-Agent. Every other client receives the decision exactly as before, so a gate that mirrors this schema strictly never meets a field it does not know. On this operation, a context.decionis_policy is treated as on evaluate-decision: its sha256 must be the SHA-256 of its content, and one that asks for enforce: true has its policy file published as the workspace's enforced policy only when the key holds policy:write, policy:* or org:*; for any other key the decision is unaffected, nothing is published, and the response carries x-decionis-warning: POLICY_ENFORCE_SCOPE_MISSING. No other operation whose body or answer carries an execution intent (verify-token, consume-token, claim-token, or the execution grant of /v1/ucp/checkout/authorize) publishes a policy file or sends that header, whatever the key holds. A key whose only evaluation scope is decision:shadow (an AgentSafe hosted gateway's) runs SHADOW and nothing else: any other mode answers 403 DECISION_SHADOW_MODE_DENIED, a body carrying context.decionis_policy, evidence or escalation answers 400 DECISION_SHADOW_FIELD_DENIED (naming the field), and the evaluation is recorded and signed without dispatching to the organization's integrations.

{
  "verification": {
    "signature_algorithm": "HMAC-SHA256"
  }
}