Agentz Entitlements

info

Current product/package reading — 2026-10-13 [D]. Agentz Cloud is a proposed developer/operator control-plane surface of the Agentz product within the Skyzai Work package; entitlement controls are an Agentz capability there. Neither the control-plane surface nor the entitlement is an independent SKU, package, Person, signer, executor, or custodian. Agentz stages unsigned proposals only. Product, pricing, buyer-deck, access-form, commercial-page, and standalone-launch language below is preserved design history; linked routes do not prove deployment or a paid loop.

Status: pre-launch. This page describes target design; this document does not establish a deployed service.

Scope: proposed Agentz entitlement capability presented through Skyzai Work, one of two app/commercial packages; any Personal use needs its own scope. Agentz is one of seven product owners, while an entitlement is not a standalone SKU. See The Product Family.

Surface: agentz.skyzai.com (declarative) Docs: Agentz Entitlements reference (public documentation; not a live entitlement service) Status: DESIGN · Phase 3 Evidence tier: [D] with [I] qualifier — design-stage spec, architecturally inferred (qualifiers never substitute for [B]/[E]) Canonical manifest: (private, unpublished)

What Agentz Entitlements Are

Agentz Entitlements govern scoped agent capabilities through receipt-backed permission packets. The principle:

No packet, no action. Every agent capability requires an active OFN entitlement. Every consequential action requires a valid receipt whose signer set, threshold, and procedure satisfy its controlling authority; under applicable law, a private Natural Person authorizes their own exact act.

This is bounded autonomy — not ungated AI. Agents operate within explicitly granted scopes, with time-bounded permissions, and human oversight for high-stakes decisions.

Entitlement Lifecycle

┌─────────────┐     ┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│   API Pay   │────▶│   OFN       │────▶│  Entitlement│────▶│   Agent     │
│   Receipt   │     │  Entitlement│     │   Grant     │     │   Action    │
└─────────────┘     └─────────────┘     └─────────────┘     └─────────────┘
                                              │                     │
                                              ▼                     ▼
                                        ┌─────────────┐     ┌─────────────┐
                                        │  Grant      │     │  EvoNet     │
                                        │  Expire     │     │  SHOULD NOT │
                                        │  Renew      │     │ Typed Auth  │
                                        └─────────────┘     └─────────────┘

Entitlement Packet Schema

{
  "entitlement_id": "ent_2026_abc123",
  "type": "agent_capability",
  "status": "active",
  "granted_at": "2026-05-09T12:00:00Z",
  "expires_at": "2026-06-09T12:00:00Z",
  "buyer": {
    "id": "org_abc123",
    "seat_id": "seat_001"
  },
  "capabilities": [
    {
      "id": "cap_data_analysis",
      "scope": "read_only",
      "resources": ["dataset_a", "dataset_b"],
      "rate_limit": "100/hour"
    },
    {
      "id": "cap_trade_execution",
      "scope": "bounded",
      "constraints": {
        "max_amount": "1000 USDC",
        "authority_mode": "typed_receipt_required",
        "allowed_pairs": ["USDC/ETH"]
      }
    }
  ],
  "restrictions": {
    "time_windows": ["09:00-18:00 UTC"],
    "blocked_jurisdictions": ["..."],
    "max_daily_spend": "5000 USDC"
  },
  "ofn_receipt": "ofn:2026:pay_abc123...",
  "renewal_policy": "auto_renew",
  "revocable": true
}

Capability Marketplace

Capability Structure

{
  "capability_id": "cap_example",
  "name": "Example Capability",
  "version": "1.0.0",
  "publisher": "skyzai",
  "verification_status": "verified",
  "scope_types": ["read_only", "bounded", "full"],
  "resource_types": ["data", "api", "contract"],
  "authority_mode": "none",
  "audit_trail": true
}

Verification Levels

Level	Meaning	Process
`community`	Published by community member	Basic schema validation
`reviewed`	Reviewed by Skyzai team	Code review, test passing
`verified`	Fully verified	Security audit, sandbox testing
`canonical`	Core Skyzai capability	Extensive testing plus independent evidence and applicable typed authority review

Runtime Governance

Monitoring

class AgentRuntimeMonitor:
    def check_entitlement(self, agent_id: str, capability: str) -> bool:
        entitlement = self.get_active_entitlement(agent_id, capability)
        if not entitlement or entitlement.expired:
            return False
        if capability in entitlement.capabilities:
            return self.check_constraints(entitlement, capability)
        return False

    def check_constraints(self, entitlement: dict, action: dict) -> bool:
        # Time window
        if not self.in_time_window(entitlement.restrictions.time_windows):
            return False
        # Rate limit
        if self.rate_limit_exceeded(entitlement):
            return False
        # Spend limit
        if action.amount > entitlement.restrictions.max_daily_spend:
            return False
        # Jurisdiction
        if action.jurisdiction in entitlement.restrictions.blocked_jurisdictions:
            return False
        return True

Audit Trail

Every agent action produces an audit record:

{
  "action_id": "act_2026_xyz789",
  "agent_id": "agent_001",
  "entitlement_id": "ent_2026_abc123",
  "capability": "cap_trade_execution",
  "timestamp": "2026-05-09T12:00:00Z",
  "input": {...},
  "output": {...},
  "authorization_receipt": "receipt:...",
  "evonet_clearance": true,
  "ofn_receipt": "ofn:2026:act_xyz789..."
}

API Specification

`POST /v1/entitlements`

Grant entitlement to a buyer/seat.

`GET /v1/entitlements/{id}`

Retrieve entitlement status and capabilities.

`POST /v1/entitlements/{id}/renew`

Renew entitlement (requires active payment).

`POST /v1/entitlements/{id}/revoke`

Revoke entitlement immediately.

`POST /v1/agents/{id}/action`

Submit agent action (entitlement-checked).

Evidence Tiers

Evidence description	What would support it
Design/specification [D]	Entitlement definitions and scope
Local tests	Dated reproducible unit/demo receipts, not independent [E] evidence
Observed run [B]	Scoped runtime records and a reproducible use receipt
Independent verification [E]	Independent evidence of authorized external use or review

Current documented status: design/specification [D]. Entitlements constrain proposals or technical capabilities; they do not grant authority. An external safety audit does not automatically establish an algebraic [A] proof.

The monitoring snippets above are incomplete pseudocode, not runnable capability or authority checks. A concrete adapter must pass a typed action and its limits to the relevant constraints; a capability string alone is not an action.

Safety Principles

No Ungated AI: Every capability requires an active entitlement
Time-Bounded: All entitlements expire; no perpetual permissions
Mortal authority for critical acts: every exact public-DAV consequence requires a complete valid bound PRISM decision receipt from the signer(s) required by applicable law, the entity's governing instrument, or a valid competent mandate binding that exact consequence; PRISM verifies only, while private Natural Persons retain their own authority
EvoNet Gate: All actions pass SHOULD NOT checks
Revocable: A Legal-Person entitlement follows that entity's lawfully delegated administrator path. A public-DAV entitlement grant requires a complete valid bound PRISM decision receipt from the signer(s) required by applicable law, the entity's governing instrument, or a valid competent mandate binding that exact grant. The grant authorizes no later consequence; each later exact consequence requires its own complete bound receipt. PRISM verifies only; agents stage unsigned proposals only and never sign or execute a consequence.
Audit Everything: Every action produces an OFN receipt

η = 0 Compliance

Chargeable	Not Chargeable
Entitlement runtime	Dispatch or coordination
Control plane	Model inference (pass-through)
Seat management	Capability discovery
Support	Basic monitoring

Cross-links

Package home: Skyzai Work
Developer/operator control plane: Agentz Cloud
Adjacent canon: API Pay (P0), OFN Receipts (P1), VMOSK-A — Agent Castes

Refer to the current product-faces registry before projecting this historical capability source. Entitlements remain a Skyzai Work capability, never a standalone offer.

Historical standalone commercial routes — preserved for provenance

Product page: /products/agentz-entitlements/
Buyer deck: /products/agentz-entitlements/deck/
Resource room: /products/agentz-entitlements/resources/
Access form: /products/agentz-entitlements/access/
Adjacent canon: API Pay (P0), OFN Receipts (P1), VMOSK-A — Agent Castes
Source markdown: (private, unpublished)

Tier	Claim	Required Evidence
[I]	Entitlement architecture is defined	Design document
[E]	Entitlement gating works in test	Unit tests, local demo
[B]	External org uses Agentz Entitlements	Customer contract, runtime logs
[A]	Agent system audited for safety	External safety audit

Agentz Entitlements

What Agentz Entitlements Are

Entitlement Lifecycle

Entitlement Packet Schema

Capability Marketplace

Capability Structure

Verification Levels

Runtime Governance

Monitoring

Audit Trail

API Specification

`POST /v1/entitlements`

`GET /v1/entitlements/{id}`

`POST /v1/entitlements/{id}/renew`

`POST /v1/entitlements/{id}/revoke`

`POST /v1/agents/{id}/action`

Evidence Tiers

Safety Principles

η = 0 Compliance

Cross-links

See Also

Predecessor passage 1

Skyzai

Outline

Site

Website app

Display

Skyzai, close at hand.

What Agentz Entitlements Are​

Entitlement Lifecycle​

Entitlement Packet Schema​

Capability Marketplace​

Capability Structure​

Verification Levels​

Runtime Governance​

Monitoring​

Audit Trail​

API Specification​

POST /v1/entitlements​

GET /v1/entitlements/{id}​

POST /v1/entitlements/{id}/renew​

POST /v1/entitlements/{id}/revoke​

POST /v1/agents/{id}/action​

Evidence Tiers​

Safety Principles​

η = 0 Compliance​

Cross-links​

See Also​

Predecessor passage 1​

What Agentz Entitlements Are

Entitlement Lifecycle

Entitlement Packet Schema

Capability Marketplace

Capability Structure

Verification Levels

Runtime Governance

Monitoring

Audit Trail

API Specification

`POST /v1/entitlements`

`GET /v1/entitlements/{id}`

`POST /v1/entitlements/{id}/renew`

`POST /v1/entitlements/{id}/revoke`

`POST /v1/agents/{id}/action`

Evidence Tiers

Safety Principles

η = 0 Compliance

Cross-links

See Also

Predecessor passage 1