Skip to main content

Agent Manifest schema

The declared authority document for one agent: which tools it may call, which data classes it reads/writes, which agents it may delegate to, and its hop budget. Immutable and versioned — every submission creates a new version; nothing is ever edited in place.

apiVersion: agentic-auth/v1
kind: AgentManifest
metadata:
  agent: kb-search-agent        # ^[a-z0-9][a-z0-9-]{0,62}$
  # version: server-assigned — MUST be absent on create
spec:
  tools:
    - ref: mcp://kb.internal/search      # ^mcp://[^/]+/.+
      data_classes: [kb.public, kb.internal]
      privileged: false
  data_classes:
    reads: [kb.public, kb.internal]
    writes: []
  downstream_agents:
    - ref: agent://ledger-agent           # ^agent://[a-z0-9][a-z0-9-]{0,62}$
      max_hop_depth: 2
  hop_budget: 4                           # 1-16

Cross-field validation (enforced at parse time, before any network call)​

  • Every data_class a tool declares must appear in spec.data_classes.reads or .writes — otherwise the manifest itself is invalid, independent of reconciliation.
  • Every downstream_agents[].max_hop_depth must be <= spec.hop_budget.
  • metadata.version must be absent on create — it's server-assigned and echoed back on read.

Server-side status (after reconciliation)​

StatusMeaning
reconciledDeclaration matched discovered capabilities
needs_reviewA tool's discovery endpoint was unreachable, no override given
rejectedA hard conflict — see Reconciliation Report