Observability tools log what an agent did. We prove what it was authorised to do.
ParCor builds the authorisation and evidence layer for enterprise AI agents — a verifiable chain from a board resolution to the transaction an agent just attempted.
Companies let agents do the buying. Not the committing.
An enterprise can put a thousand agents into production and still cap each of them at a few hundred euros. Not because the agents are unreliable — because nobody can prove the agent was authorised.
A counterparty asked to accept an agent's commitment has no way to establish that a real signatory, at a real company, granted that specific authority, for that specific purpose, and had not revoked it three minutes earlier. So the counterparty waits for a human signature, and the ceiling stays where it is.
That ceiling is not a capability limit. It decides which work a company is permitted to automate.
Authority descends. Scope only narrows.
Every action an agent takes resolves to an unbroken chain of cryptographic grants terminating in a named human signatory and the document that gave them the power to sign. Each hop may narrow what the one above it permitted. None may widen it.
The legal entity. Root grant signed in hardware by a named signatory, against the board resolution that confers the authority.
- type
- root
- principal.lei
- <20-character LEI>
- authority_evidence
- board_resolution · document_hash · signatory_verification
- signature
- ECDSA P-256 · FIPS 140-2 Level 3 HSM · eIDAS qualified
- validity
- up to 12 months
A department or programme owner sub-delegates a subset. The verifier computes the intersection of every grant in the chain — a sub-grant that widens any dimension is invalid, not merely capped.
- type
- sub
- parent_grant_id
- ← root
- delegation
- may_sub_delegate: true · max_depth_remaining: 2
- scope
- categories ⊆ parent · counterparty_classes ⊆ parent
The agent holds a short-lived operational grant, refreshed automatically while the authority above it stands, and revocable in seconds when it does not.
- grantee.did
- did:parcor:<agent identifier>
- keys
- Ed25519
- validity
- 24 hours, auto-refreshed
- scope
- max_single_amount · aggregate_window · counterparty_allowlist
- revocation
- status_list_index · effective within 5s
One attestation per action, carrying the full chain and the aggregate consumed before and after. Verification is a pure function of the attestation, the grant chain and time — it consults no mutable state, because it will be run years later, by third parties, possibly in a dispute.
- grant_chain
- [ root → delegation → agent ]
- aggregate_state
- consumed_before · consumed_after · limit
- nonce
- unique per agent — replay is rejected
- timestamp
- RFC 3161 token · eIDAS qualified TSA
- anchor
- Merkle root committed every 60 seconds
Illustrative. Field names and constraints follow the Authorisation & Attestation Chain specification, v0.1 draft. Amounts shown are delegated spending authority, in the sense a corporate card limit is.
What the system commits to.
| Property | Commitment |
|---|---|
| Maximum delegation depth | 3 |
| Operational grant validity | 24 h, auto-refreshed |
| Root grant validity | ≤ 12 months, HSM-held |
| Revocation effective within | 5 s |
| Anchor interval | 60 s |
| Scope composition | intersection only — never union |
| Root signature | ECDSA P-256 / RSA-3072, eIDAS qualified |
| Agent signature | Ed25519 |
| Post-quantum hedge | SLH-DSA commitment per anchor |
| Timestamping | RFC 3161, qualified TSA |
| Verification | pure function of attestation, chain and time |
A different layer from the platforms agents run on.
Agent platforms
Decide what an agent should do. Orchestration, tools, reasoning, task execution. A vendor's own account of its customer's authority is not evidence about that customer's obligations.
ParCor
Establishes whether an agent is allowed to spend, and who stands behind it. Different layer, no overlap, nothing to rip out.
If AI agents are going to buy from you, they have to be able to check you first.
An agent that cannot confirm who it is dealing with will not deal at all — and an agent that cannot prove its own authority gives you no reason to accept its order. Both problems are the same problem, seen from opposite sides of the table.
We are opening a register of verified businesses: identity checked once and properly, settlement details attested, terms published in a form an agent can read, and able to accept and check an agent's proof of authority. Verified, dated, and re-checked on a schedule.
Registration opens ahead of the first customer deployments. If you sell to companies whose agents are starting to buy, tell us and we will bring you in early.
Verification that does not depend on us.
A standalone verifier is published as open source, with no dependency on our infrastructure beyond fetching anchor roots from the transparency log. A counterparty, auditor, rating agency or opposing expert must be able to check a chain without our cooperation.
Any verification that requires trusting us is worth little in the dispute it exists to prevent.
Authorisation & Attestation Chain Spec · §8.1