Logos does not decide identity by itself. It verifies a signed intent envelope, checks that the token matches a registered vocabulary, confirms context and required proofs, then returns the local handler that may run.

Execution Boundary

Signed envelope arrives

The agent, gateway, or service presents a Logos signed token envelope before a privileged action runs.

Signature and expiry are checked

The SDK verifies the HMAC signature, key id, issued time, and expiry window with server-managed secrets.

Vocabulary is resolved

The token intent id is resolved against a registered vocabulary version. Unknown vocabulary or intent ids fail closed.

Context, params, and proof are validated

The SDK checks the expected context, required parameters, and satisfied proof names such as human_approval or vinac_fm_level_3.

Handler is returned or denied

Only a valid token returns a local handler. The action still executes in your runtime, not inside SilentAuth.

What Gets Checked

FieldWherePurpose

signaturesigned envelopeDetects token tampering before local resolution.

expiresAtsigned envelopeLimits replay windows for tokens crossing trust boundaries.

allowedContexts.logos vocabularyKeeps an intent bound to the runtime or workflow it was designed for.

parameterKeys.logos vocabularyRequires the parameters the handler needs before dispatch.

requiredProofs.logos vocabularyRequires proof names such as human_approval or vinac_fm_level_3.

handler.logos vocabularyReturns a local handler name after every validation gate passes.

Fail-Closed Rules

Unknown vocabulary

If the vocabulary version is not registered locally, the token cannot resolve.

Missing proof

If a required proof is not in satisfiedProofs, the SDK returns missing_required_proof.

Context mismatch

A payment token cannot be resolved inside an agent runtime context by accident.

Unsigned input

Unsigned tokens should stay internal. Use signed envelopes across service boundaries.

Code Examples

approved execution boundary

const checked = await lexicon.verifyAndResolve(signed, {
  secret: process.env.LOGOS_HS256_SECRET!,
  resolution: {
    context: "ai_agent_runtime",
    satisfiedProofs: ["human_approval", "vinac_fm_level_3"]
  }
});

if (!checked.ok) {
  throw new Error(`Logos denied: ${checked.reason}`);
}

await handlers[checked.resolved.handler](checked.token.params);

denied because VINAC-FM proof is missing

const checked = await lexicon.verifyAndResolve(signed, {
  secret: process.env.LOGOS_HS256_SECRET!,
  resolution: {
    context: "ai_agent_runtime",
    satisfiedProofs: ["human_approval"]
  }
});

// {
//   ok: false,
//   reason: "missing_required_proof",
//   validation: { missingProofs: ["vinac_fm_level_3"] }
// }

local validation without a signed envelope

const validation = lexicon.validate(token, {
  context: "ci_cd",
  satisfiedProofs: ["maintainer_approval"]
});

if (validation.ok) {
  const action = lexicon.resolve(token, {
    context: "ci_cd",
    satisfiedProofs: ["maintainer_approval"]
  });
}

SDK Guide

Compile, sign, verify, and map tool calls

Vocabulary Reference

Seed CSIV intent examples and namespaces