Core Primitives

Everything in Ovara builds around five primitives.

AgentIdentity

The stable identity of a machine actor, backed by ed25519 key pairs. Every agent the gateway knows has a verifiable identity independent of whatever the LLM claims.

CapabilityLease

A short-lived, scoped delegation of authority. A lease says: this agent may perform this class of action, in this environment, until this time, at most this many times - and it expires. Enforces least-privilege across agent fleets instead of long-lived service credentials.

DelegationChain

The verifiable lineage of authority transfer. Chains carry SHA-256 hash lineage so the gateway can answer "who delegated this authority, and through whom."

Chain detection catches abuse patterns:

• Self-delegation - an agent delegates to itself
• Excessive depth - delegation chain too deep
• Issuer concentration - too many leases from a single issuer
• Rapid re-delegation - frequent re-delegation suggesting laundering

Suspicious chains are escalated regardless of policy.

TrustContext

The current risk posture used during authorization. The trust score feeds policy rules, so a risky agent faces stricter rules than a healthy one.

The scoring formula:

trust_score = base_score
  * isolation_multiplier
  * patch_freshness
  * drift_penalty
  * degradation_penalty
  + trust_score_hint * 0.1

• base_score = 0.5
• Isolation multipliers: none = 1.0, docker = 1.05, gvisor = 1.15, firecracker = 1.2
• Patch freshness decays from 1.0 to 0.5 at 90 days
• Levels: high (0.8-1.0), medium, low, none

Sliding-window action pattern analysis detects drift; trust degrades exponentially with streak acceleration.

A trust-dependent policy rule looks like:

{ "min_trust_score": 0.7 }

If the agent's current trust score is below 0.7, the action escalates for human review.

ExecutionReceipt

The signed record of a decision and the resulting action. Gateway-domain receipts use HMAC-SHA256 with a deterministic action digest (sig_v1:<hex>). Modifying any field of a receipt invalidates its signature.

For federated deployments, cross-org receipts use ed25519 signatures instead: the format includes the issuing organization's public key and is independently verifiable without access to the issuing gateway.

The decision flow

For every intercepted action the gateway runs:

1. Identity verification - ed25519 check of AgentIdentity
2. Capability lease validation - scope, expiry, delegation depth
3. Policy evaluation - rules against action, environment, trust
4. Risk + trust evaluation - drift and anomaly signals
5. Decision - allow, deny, or escalate
6. Receipt - signed record appended to the audit trail