RFC 0006: Published guardrail vocabularies — meaning as a resolvable third party

[scott-wyatt]

Problem

Two agents can prove who authorized an act. They cannot agree on what the act was.

APH binds payload, channel, agent, and policy decision to a human's authority — all structural. Nothing says whether the message asked to grant access, move money, or schedule a meeting, which is what a recipient's policy actually turns on. Two recipients can read the same signed bytes, reach different conclusions about what was asked, and both be conformant.

The guardrail vocabulary closes half of this: families of acts and labels, versioned independently of the wire. It already states the intent — "A vocabulary that resolves independently is a third party both sides can point at… Neither counterparty defines the term; both resolve it."

But it does not resolve. It is a file in this repository, and its README says plainly that no wire binding exists. So the third party both sides point at is, at present, us.

Proposal

Two halves, and the design proposes almost no new mechanism:

1. Anyone can author a vocabulary — as a tighten-only overlay against the base, using the lattice rules that already ship. A publisher can add a label, raise a floor, harden a fail posture — and never the reverse. Six families (authority, consent, safety, injection, disclosure, human-loop) are sealed and refuse overlays entirely.
2. Publication reuses §8.4 rather than inventing a second discovery story. A vocabulary is the same problem shape as a notary key: resolve a third party you have no prior relationship with.

References are a logical identifier plus content digest — name, version, digest, family, label — never a path into the serialization. That distinction was learned the expensive way: re-exporting an unchanged bundle under a newer toolchain moved its blocks from one nesting to another, and a signature cannot be re-pointed.

Full draft: rfcs/0006-published-guardrail-vocabularies.md

What most needs discussion

• The outbound-fetch hazard. Resolving a stranger's vocabulary is a request to a stranger's server made by a verifier while it verifies — SSRF, DoS-on-verify, and a privacy side channel. The draft argues for out-of-band resolution with digest-pinned caching as the default, never a lazy fetch triggered by an inbound envelope.
• Where the reference belongs — envelope, mandate, or both. A mandate-side reference would let a human's grant be scoped in terms both parties resolve, which is a strictly larger idea.
• Unmeasured accuracy claims. Families carry min_accuracy gates while the corpora do not ship. Publishing makes those claims look more official than they are.
• Seal enforcement is a consumer property, not a property of the bytes. Publication raises the stakes on that considerably.

The honest limit

A vocabulary reference proves which vocabulary the sender cited, not that the sender classified correctly. What it buys is that a disagreement becomes visible instead of a misunderstanding staying invisible. That is valuable and it is not integrity of classification; no implementation should describe it as the latter.

[scott-wyatt]

Accepted 2026-08-28.

Two things changed between draft and acceptance, both recorded in the RFC's Decision block.

The wire binding is folded in (§5). The draft left it open, which made this a design nobody could adopt — a vocabulary reference that cannot be carried is a comment. The governing fact turned out to decide the shape before any field was named: every wire struct in the reference carries deny_unknown_fields, so there is NO place in an envelope that tolerates an unrecognized member. An older verifier meeting a new field fails at strict parse, before the protocol's own error vocabulary is reachable — so any binding is version-gated, with the same producer rule that governs a new closed-vocabulary value.

The field is credentialSubject.actClassification, optional and omitted when absent. Both its members are lists: labels because one act carries verdicts from several families at once, and vocabularies because an overlay is a separate published artifact with its own digest — naming only one when a verdict was folded from two would put a false statement inside a signature.

One error corrected before it became expensive. The draft claimed _aph._vocab would cost "one line in the same registration". RFC 8552 registers the label closest to the root — _notary for the deployed name, _vocab for this one — so it is a second registration, for a more generic label than the first. Ruled: take it, and keep the name shape, because _aph._notary is already live in DNS and shipped in code. The fix lands before the pending IANA submission rather than after.

Limitations, stated plainly: decided by a sole maintainer with no second reviewer, the third such acceptance in one day. No vocabulary has been published by anyone yet, so the publication design is reviewed and not exercised — the first real publisher will find things this document did not.

Acceptance authorizes the normative change to move into the spec under the ordinary review rules. It does not itself change the spec: until that text lands, actClassification is not a field and an envelope carrying it is correctly refused.