--- title: "Authority Lifecycle — KYE Protocol™ end-to-end state visualisation" description: "The full KYE™ authority lifecycle, end to end — from entity declaration to Authority Finality™. Ten signed states, every transition observable, every Evidence Pack™ replayable from public keys alone." url: https://kyeprotocol.com/authority-lifecycle/ lang: en source: "KYE Protocol" --- > The full KYE™ authority lifecycle, end to end — from entity declaration to Authority Finality™. Ten signed states, every transition observable, every Evidence Pack™ replayable from public keys alone. # From entity declaration to Authority Finality™ — every state visible, every transition signed. Behavioural control planes intercept at one point in the chain — the gateway check. KYE Protocol™ owns the whole timeline: ten signed states from the moment an entity declares its key material through to the Evidence Pack™ that any auditor can replay from public keys alone. [Authority Finality™](https://kyeprotocol.com/authority-finality/) [Evidence Pack™](https://kyeprotocol.com/evidence-pack/) ### Signed at T=0 Every state transition emits a signed event onto the audit chain at the moment it occurs — not a post-hoc log scrape. ### Replayable from public keys An Evidence Pack™ can be re-verified by any third party with nothing but the JWKS and the bundle. ### Commit-boundary enforced The Authority Gateway™ sits on the integrating system's commit boundary — before the action executes, not after. ### Six-dimension state vector Identity, authority, delegation, credential, recovery and risk transition independently — a single failure changes the right dimension without nuking the rest. Why this matters ## Authentication answers _who logged in_. The lifecycle answers who is authorised to act, right now, under what scope, with what evidence. An AI agent action is not a single event. It is a chain: a principal delegated authority, an agent attenuated it, a tool was called, a gateway evaluated, a verdict issued, an Evidence Pack™ sealed. A control plane that intercepts only at the gateway has no answer for the seven hops before and after. KYE Protocol™ declares each one explicitly, signs each transition, and makes the whole timeline replayable. The ten states ## From declaration to finality — ten signed states, one continuous chain. Each card carries a real artefact: a JWKS URL, a delegation envelope fragment, a state-vector value, an Evidence Pack™ hash. These are the shapes that traverse the wire — not pseudo-code, not "imagine if". ### 1. Entity declares An organisation publishes its key material under a canonical KYE™ ID and a JWKS endpoint. This is the root of trust every downstream signature resolves to. Proof artefact · JWKS endpoint GET https://acme.example/.well-known/kye/jwks.json → { "keys": \[ { "kid": "kye:org:gb:acme#sig-2026", "alg": "EdDSA", ... } \] } 01 02 ### 2. Principal grants A human or service principal signs a delegation envelope: who, to whom, what scope, what expiry, what attenuation rules. The envelope is published to the audit chain at the moment of signing. Proof artefact · `kye.delegation.v1` envelope { "delegator": "kye:org:gb:acme", "delegatee": "kye:agent:gb:acme:purchasing-bot-7", "scope": \["payment.prepare:<=1000GBP", "supplier:approved-list"\], "expires": "2026-06-15T00:00:00Z", "sig": "ed25519:..." } ### 3. Chain hop The agent may sub-delegate to a tool, a sub-agent, or a downstream service — but only with attenuated scope. Every hop appends a signed link; no hop can widen what its parent granted. Proof artefact · attenuation rule parent.scope ⊇ child.scope ← enforced at sign-time parent.expires ≥ child.expires ← enforced at sign-time chain\_depth ≤ 5 ← policy-bound 03 04 ### 4. Agent intends action The agent forms an intent: call a tool, prepare a payment, draft a document. The intent is itself a signed object — the runtime captures it before any side effect is attempted. Proof artefact · intent envelope { "actor": "kye:agent:gb:acme:purchasing-bot-7", "action": "payment.prepare", "target": "supplier:acme-supplier-00482", "amount": { "value": 950, "currency": "GBP" }, "delegation\_chain": \["env:abc...", "env:def..."\] } ### 5. Gateway checks The KYE™ Authority Gateway™ intercepts at the commit boundary — the moment the action would cross into the world. It loads the delegation chain, the state vector, the scope and the applicable policy bundle. Proof artefact · commit-boundary hook POST /kye/authority/check X-Kye-Intent-Sig: ed25519:... body: { intent, chain, state\_vector\_snapshot } → 200 (admit | deny | escalate | evidence-insufficient) 05 06 ### 6. State vector resolved The six independent dimensions are snapshotted at decision time. Each one cascades independently — expire a credential, watch only `credential_state` flip; freeze authority, only `authority_state` moves. Proof artefact · six-dimension state vector entity\_state: active authority\_state: scoped delegation\_state: active credential\_state: valid recovery\_state: healthy risk\_state: nominal ### 7. Verdict issued One of four verdicts is returned — `admit`, `deny`, `escalate`, or `evidence-insufficient` — with a signed Decision Map™ citing every rule that fired and every state value that influenced the outcome. Proof artefact · verdict + decision map { "verdict": "admit", "decision\_map\_sha256": "9f3e...", "rules\_fired": \["scope.in\_bounds", "amount.under\_cap", "supplier.approved"\], "signed\_at": "2026-05-30T11:02:14Z" } 07 08 ### 8. Action executes — Authority Finality™ The integrating system either executes the action or refuses. Either way, the outcome is sealed: the moment the gateway returned a verdict, the authority decision became final and immutable. Nothing downstream can mutate it. Proof artefact · finality marker finality\_reached\_at: 2026-05-30T11:02:14.218Z verdict\_sha256: a14c... downstream\_action: committed | refused mutability: immutable (verdict frozen at T=0) ### 9. Evidence Pack™ sealed The runtime composes the intent, the delegation chain, the state vector snapshot, the policy bundle hash, the verdict and the execution outcome into one signed bundle. Any auditor can replay it from public keys alone — no live KYE™ call required. Proof artefact · Evidence Pack™ seal { "pack\_id": "ep:2026-05-30:purchasing-bot-7:11020014", "bundle\_sha": "c8d2...", "replay\_seed":"4f0a...", "issuer\_kid": "kye:org:gb:acme#sig-2026", "sig": "ed25519:..." } 09 10 ### 10. Lifecycle event After finality, the lifecycle continues. Revocations propagate recursively down delegation chains; expiries trigger automatic `delegation_state: expired` transitions; audits replay sealed packs years later from the JWKS alone. Proof artefact · revocation event { "event": "delegation.revoked", "subject": "kye:agent:gb:acme:purchasing-bot-7", "cascade": \["env:abc...", "env:def..."\], "reason": "principal.requested", "emitted": "2026-05-30T14:48:02Z" } **Why the whole timeline matters.** A behavioural-control plane that intercepts only at state 5 (the gateway check) cannot answer: _where did this authority come from?_ (states 1–3), _what was the intent we evaluated?_ (state 4), _what was the decision shape?_ (states 6–7), _what evidence survives?_ (state 9), _what happens when authority is revoked tomorrow?_ (state 10). KYE Protocol™ declares each one as a signed state — not as a log line. Related ## Three pages that complete the picture. [**Evidence Pack™ demo →** A live, signed bundle of an Observed Action, Shadow Evaluation, Authority Gap and Guard Recommendation. The artefact from state 9, in detail.](https://kyeprotocol.com/evidence-pack-demo/) [**Protocol overview →** The full protocol map — the six-dimension state vector from state 6 with its 15 lifecycle values, plus the conformance pack vocabulary.](https://kyeprotocol.com/protocol/) [**Architecture →** One canonical root, many projections. How this lifecycle fits inside the three macro groups and the eight public surfaces.](https://kyeprotocol.com/architecture/) Canonical KYE™ surfaces referenced on this page: [KYE™ Conformance Pack™](https://kyeprotocol.com/compliance/) · [KYE Protocol™](https://kyeprotocol.com/).