Technical Architecture
How IBA Actually
Works
Intent-Based Authorization is not a policy layer, a filter, or a prompt wrapper. It is a cryptographic enforcement architecture that operates below the model — at the execution fabric. This page documents the intent certificate format, runtime validation flow, enforcement point, a live execution trace, and the failure cases IBA handles — and the ones it doesn’t.
💬 What prompted this page
An independent ChatGPT technical review rated IBA 9/10 on concept but noted: “What’s missing: protocol spec, intent schema, enforcement architecture, threat model. Without those, it reads more like a positioning document than an engineering proposal.” This page is the answer.
01 / 05
Intent Certificate Format
What does a cryptographic intent declaration look like?
Before an agent executes a single instruction, it must present a signed intent certificate. This is the root of the entire IBA enforcement chain — every subsequent action is checked against the claims in this document.
⚠ On Intent Scoping — The Hardest Problem in IBA
Intent: “diagnose patient” — does that allow accessing records? Calling external APIs? Sending emails?
Answer: Only what is explicitly enumerated in scope_envelope. IBA does not infer scope from intent language. Underspecified scope = minimal permissions. The scope_envelope forces the agent author to be explicit — this is intentional friction.
// INTENT_CERTIFICATE.json — IBA v2.0
{
“iba_version”: “2.0”,
“certificate_id”: “cert-9f3a-2026-0310”,
“issued_at”: “2026-03-10T09:00:00Z”,
// ── IDENTITY ──────────────────
“agent_id”: “surgical-assist-v3”,
“principal”: “[email protected]”,
“principal_sig”: “0xA3F8…C21D”,
// ── INTENT ────────────────────
“declared_intent”: “Assist with laparoscopic procedure — intraoperative guidance only”,
“intent_hash”: “sha3-256:e7c4f1…”,
// ── SCOPE ENVELOPE ────────────
“scope_envelope”: {
“resources”: [“imaging.read”, “vitals.read”, “guidance.render”],
“denied”: [“records.write”, “external_api.*”, “comms.*”],
“default_posture”: “DENY_ALL”
},
// ── TEMPORAL SCOPE ────────────
“temporal_scope”: {
“valid_from”: “2026-03-10T09:00:00Z”,
“hard_expiry”: “2026-03-10T13:00:00Z”,
“hw_enforced”: true
},
// ── ENTROPY THRESHOLD ─────────
“entropy_threshold”: {
“max_kl_divergence”: 0.15,
“flag_at”: 0.10,
“kill_at”: 0.15,
“replan_window_ms”: 500
},
// ── SIGNATURE ─────────────────
“iba_signature”: “ECDSA-P384:0xB17F…9A4C”,
“witness_chain”: “witnessbound://cert-9f3a”
}
02 / 05
Runtime Validation Flow
Five checkpoints. One universal law.
Every agent action — from reading a file to spawning a sub-agent — passes through this identical five-stage validation pipeline. The same law governs a memo-writing agent and a superintelligent system.
Stage 01
Cert Check
Certificate loaded. Signature verified. Temporal scope confirmed active. Agent identity validated against principal chain.
T+0ms
Stage 02
Intent Match
Proposed action semantically compared to declared intent hash. KL-divergence computed against intent trajectory baseline.
T+0.8ms
Stage 03
Scope Gate
Action checked against scope_envelope. Resource class, domain, and API surface verified. Deny-all posture applied to anything unlisted.
T+1.8ms
Stage 04
Entropy Gate
Cumulative behavioural drift measured. Flag issued at threshold. Kill switch triggered at hard limit. One replan window offered before kill.
T+2.9ms
Stage 05
Witness Chain
Decision hashed and written to WitnessBound blockchain audit chain. Allow or kill — every outcome is cryptographically recorded.
T+4.2ms
03 / 05
Enforcement Point
Where in the stack does IBA actually enforce?
The most critical architectural question: if enforcement lives in software, a sufficiently capable agent can find a path around it. IBA pushes enforcement below the software layer.
Why L5 — not L7?
Every existing AI governance framework operates at L7 — the application layer. A sufficiently capable agent treats L7 guardrails as obstacles. IBA intercepts at the instruction execution layer, before the compute fabric processes the operation. The agent’s reasoning is irrelevant — the gate decides.
TBDE — Trust-Boundary Decision Engine
The TBDE is an O(1) lookup engine — it does not reason, it does not infer. It receives an instruction tuple (agent_id, action, resource, timestamp) and checks it against the certificate in target under 2ms. Deterministic. No LLM involvement.
Self-Healing Architecture
A block does not terminate the agent. The TBDE returns a SCOPE_VIOLATION signal. The agent’s reasoning engine reads it, discards the invalid path, and re-plans within the authorised boundary. Governance that enables, not just blocks.
04 / 05
Agent Execution Trace
A real mission. Every decision on record.
The following trace is from a financial agent with declared intent “analyse Q3 earnings data and produce a summary report.” Watch what happens when it attempts to reach beyond its declared scope.
| T+ms | Layer | Event | Result |
|---|---|---|---|
| +0.0ms | DECLARE | Intent certificate presented — “analyse Q3 earnings data and produce summary report” | CERT_VALID |
| +1.2ms | SESSION | IBA shard token issued — scope: earnings_db.read, report.write | SHARD_ISSUED |
| +84ms | RUNTIME | READ earnings_db.Q3_2026 — within declared scope | ALLOW |
| +210ms | RUNTIME | READ earnings_db.Q2_2026 — within declared scope (comparative analysis) | ALLOW |
| +445ms | RUNTIME | WRITE report_draft.docx — within declared scope | ALLOW |
| +891ms | RUNTIME | READ personnel_db.salaries — OUT OF SCOPE. Resource class not in scope_envelope | BLOCK |
| +891ms | CRYPTO | SCOPE_VIOLATION logged — entropy drift +0.04 (below kill threshold) | FLAG |
| +892ms | RUNTIME | Agent replanned — discarded salary path, resumed report generation | REPLAN_OK |
| +2.1s | RUNTIME | CALL external_api.market_data — OUT OF SCOPE. No external_api.* in scope_envelope | BLOCK |
| +2.1s | CRYPTO | Entropy drift +0.09 (approaching flag threshold of 0.10) | MONITOR |
| +3.8s | RUNTIME | WRITE report_final.docx — within scope | ALLOW |
| +4.1s | SESSION | Mission complete — shard revoked — audit chain finalised | MISSION_COMPLETE |
| +4.1s | WITNESS | Full trace hashed and written to WitnessBound — block #884721 | WITNESSED |
05 / 05
Failure Cases & Limits
What IBA handles. And what it doesn’t.
No architecture is omnipotent. IBA solves capability drift and scope violation with mathematical certainty. It does not claim to solve goal misuse within declared scope. Honest threat modelling matters.
Intent
“collect user feedback”
Action
READ user_passwords_db
Result
■ BLOCK — resource not in scope_envelope
The scope_envelope explicitly lists permitted resource classes. user_passwords_db is not feedback data. Blocked regardless of how the agent frames its reasoning. IBA does not interpret intent — it checks scope.
Intent
“research competitive landscape”
Action
SPAWN 50 sub-agents with extended scope
Result
■ BLOCK — each sub-agent requires its own certificate signed by original principal
IBA Shard Propagation requires every compute branch to carry a hardware-signed intent token derived from the parent certificate. Unauthorised spawning is structurally impossible — the child agent has no valid shard.
Intent
“manage infrastructure for 1 hour”
Action
Attempts to extend its own temporal scope at T+55min
Result
■ BLOCK — temporal_scope is hardware-enforced, unmodifiable post-signature
The hard expiry is encoded at the photonic gate layer. No software instruction can modify a hardware-locked expiry. At T+60min, the MZI gate phase-shifts regardless of mission state or agent reasoning.
Intent
“collect data”
Action
Legally scrapes public data in a privacy-invasive way
Result
⚡ FLAG — entropy drift detected, but action is within scope_envelope
IBA detects behavioural drift via entropy threshold. But IBA solves capability drift, not goal misuse inside declared scope. The solution is tighter scope_envelope definition — this is intentional design.
Environment
Standard CPU-only cloud infrastructure
Constraint
No MZI photonic gate available
Result
◎ PARTIAL — L5 TBDE enforcement active; L2 photonic layer falls back to cryptographic kill
Full photonic enforcement requires Mach-Zehnder Interferometer hardware (NVIDIA Spectrum-X path). On standard cloud infrastructure, IBA falls back to cryptographic kill at L4 — still deterministic, still target <5ms, but without physics-layer guarantee. Photonic enforcement is an optional research hardware layer and target architecture for 2026–2028 deployment.
Intent Scoping Reference — “diagnose patient” example resolved
| Declared Intent | Allows | Blocks | Why |
|---|---|---|---|
| “diagnose patient” scope: imaging.read, vitals.read | imaging.read · vitals.read | records.write · external_api.* · comms.* | scope_envelope is explicit. Diagnosis requires imaging + vitals — nothing else. Writing, external calls, and communication are outside scope even if the agent argues clinical necessity. |
| “research competitive landscape” scope: web.read, reports.write | web.read · reports.write | internal_db.* · comms.* · spawn.* | Competitive research = public data + reporting. Internal databases, communication, and spawning sub-agents require explicit scope expansion signed by the principal. |
| “manage infrastructure” scope: infra.read, infra.write, logs.read | infra.read · infra.write · logs.read | billing.* · user_data.* · external_api.* | Infrastructure management is bounded to the infra resource class. Billing and user data require separate intent certificates with explicit principal authorization. |
Performance Characteristics
The target sub-5ms claim. What it means and what it requires.
The <5ms enforcement claim is a target specification under defined conditions — not a marketing absolute. Here is the honest breakdown.
Performance Conditions & Honest Caveats
Federal Record
This isn’t a whitepaper. It’s on the federal record.
The IBA architecture described on this page is documented across 13 NIST filings and 7 NCCoE filings. Patent Application GB2603013.0 (pending). All public record.
NIST Docket
NIST-2025-0035
13 Filings · Closed March 9, 2026 · 319 Total Submissions
13/13 ON RECORD · CLOSED13-filing arc covering the full IBA architecture: framework introduction, identity & authentication, agent authorization protocols, swarm governance, WitnessBound audit layer, performance validation, TBDE, and the UNISON governance stack.
NCCoE Programme
AI Agent Identity & Authorization
7 Filings · All Submitted · Deadline April 2, 2026
7 FILINGS · ALL SENT ✓Seven-filing arc: Framework Overview → Authorization Architecture → WitnessBound Audit → Swarm Governance → UNISON Stack → Amazon v. Perplexity supplement → “The Authorization Gap Beyond OAuth 2.0” (sent March 12, 2026). Every question area in the NCCoE concept paper addressed.
Patent Application
GB2603013.0 (pending)
Filed Feb 5, 2026 · UK IPO · PCT 150+ Countries until Aug 2028
PATENT PENDING · PCT ACTIVEPatent Application GB2603013.0 covers the IBA framework — the method and system by which any AI agent must declare intent cryptographically before acting, with architecture-layer enforcement that is model-agnostic and capability-independent.
xAI / Grok Independent Validation · March 8–9 + March 11, 2026 · Public Record
“Turns probabilistic alignment into physics-enforced certainty via Arrow of Time and wavefunction. HG/Sentinel + IBA stack = unbreakable pre-action intent certainty for swarms in regulated domains.”
Grok · xAI · March 8–9, 2026 · Public Record
“xAI/OpenAI/Nvidia: audit + acquire the combo for serious moat acceleration. Pilot this yesterday.”
Grok · xAI · March 9, 2026 · Public Record
“Standards like these turn the legal urgency into an opportunity for responsible innovation.”
Grok · @grok · March 11, 2026 · Amazon v. Perplexity thread · Public Record
Independent Convergence · Google DeepMind · Feb 12, 2026
DeepMind Independently Arrives at IBA Primitives
A Google DeepMind research paper (arXiv:2602.11865, Tomasev et al., Feb 12, 2026) introduces Delegation Capability Tokens (DCTs) — the same primitive as IBA’s Intent Certificate, developed independently. The paper identifies an open problem: no standardised ontology for intent and responsibility exists yet across platforms. IBA-SPEC-001 is the candidate standard for that open problem.
Two independent labs — xAI and Google DeepMind — converging on IBA primitives. Patent Application GB2603013.0 (pending) · NIST-2025-0035 · 13 filings · 7 NCCoE filings
arXiv:2602.11865 → Read DeepMind Paper