{
  "worldauth_version": "0.1",
  "profile": "pre-1.0",
  "generated_from": "worldauth-site/.well-known/worldauth",
  "organisation": {
    "name": "UIE WorldAuth",
    "legal_entity": "UIE Ltd",
    "parent": "UIE Group",
    "jurisdiction": "GB",
    "site": "https://worldauth.com/"
  },
  "category": "Machine-native infrastructure for autonomous systems.",
  "authority_chain": [
    "Principal",
    "AuthorityMandate",
    "WorldAuthKey",
    "WorldAuthGate",
    "Decision",
    "Execution",
    "WorldAuthReceipt"
  ],
  "decisions": [
    "ALLOW",
    "DENY",
    "STEP_UP"
  ],
  "decision_notes": {
    "ALLOW": "The presented authority and policy permit the action. An ALLOW may carry obligations.",
    "DENY": "The action is not authorised under the presented authority.",
    "STEP_UP": "Additional legitimate authority or accountable approval is required first. STEP_UP is never a bypass.",
    "not_decisions": [
      "LIMIT",
      "CONFIRM"
    ]
  },
  "protocol_objects": [
    "AuthorityMandate",
    "WorldAuthKeyPresentation",
    "GateChallenge",
    "GateDecision",
    "AuthorityReservation",
    "WorldAuthReceipt",
    "StatusAssertion",
    "DelegationLink"
  ],
  "invariants": [
    "Authority is not identity.",
    "Principal and actor are distinct.",
    "Assurance evidence is never authority.",
    "Possession alone grants nothing; proof of possession is bound to a server-issued challenge and the concrete request.",
    "Delegation may only attenuate, never widen.",
    "Unknown critical semantics are non-authorising.",
    "Infrastructure failure never creates authority.",
    "Public decisions are exactly ALLOW, DENY and STEP_UP.",
    "STEP_UP creates or satisfies legitimate additional authority.",
    "Non-consumable authority may be locally verifiable.",
    "Consumable authority requires coordinated depletion."
  ],
  "status": {
    "protocol_contract": "published-pre-1.0",
    "gate_runtime": "in-development",
    "sdks": "in-development",
    "agent_framework_integration": "in-development",
    "reference_sandbox": "live-illustrative-only",
    "production_gate_endpoint": null,
    "note": "No production WorldAuth Gate is operated at this domain. This document describes posture and vocabulary; it is not an authority endpoint and returns no decisions."
  },
  "modules": {
    "DMI": {
      "name": "Direct Machine Interface",
      "status": "reference-implementation-not-deployed",
      "summary": "Exposes authoritative state, capabilities, constraints and actions directly to machines. WorldAEO remains only a compatibility-era reference implementation; no WorldAEO serving endpoint is deployed here and it grants no authority.",
      "compatibility_discovery": "https://worldauth.com/.well-known/worldaeo.json",
      "page": "https://worldauth.com/solutions#commerce"
    },
    "Authority": {
      "status": "canonical-core",
      "summary": "Mandate, Key, Gate and Receipt govern consequential actions. Identity and evidence can inform authority but never become authority.",
      "page": "https://worldauth.com/platform"
    },
    "Runtime": {
      "status": "evaluation-migration",
      "summary": "Execution and fallback runtime capabilities are being consolidated under WorldAuth DMI Runtime. The operator.worldauth.com hostname remains an evaluation compatibility surface; withdrawn paid tiers are not available.",
      "page": "https://operator.worldauth.com/"
    },
    "Evidence": {
      "status": "architectural-direction",
      "summary": "Provenance, claims and outcome evidence preserving observed, declared, inferred, verified and unknown distinctions. Grants no authority.",
      "page": "https://worldauth.com/solutions#media"
    },
    "Applications": {
      "status": "profiles",
      "summary": "Sector and deployment profiles apply the same WorldAuth platform without creating separate authority systems.",
      "page": "https://worldauth.com/solutions"
    },
    "Assurance": {
      "status": "compatibility-profile",
      "summary": "Assurance evaluates controls, evidence and accountable backing behind the Assurance Firewall. It never becomes authority.",
      "page": "https://worldauth.com/platform#firewall"
    },
    "Sovereign": {
      "status": "compatibility-profile",
      "summary": "High-assurance deployment profile under local control. Same objects, same invariants, no fork.",
      "page": "https://worldauth.com/solutions#sovereign"
    }
  },
  "exclusions": [
    "not a universal identity provider",
    "not a global reputation or trust score",
    "not a payment network, wallet, token or settlement rail",
    "not a surveillance system or central activity ledger",
    "not an insurer or risk carrier",
    "not a compliance guarantee"
  ],
  "standards": {
    "authzen-1.0": "interoperability-target",
    "cedar": "supported-not-required",
    "rfc9421": "request-integrity-and-signer-attribution",
    "rfc9449-dpop": "supported-substrate",
    "rfc9901-sd-jwt": "proposed-standard",
    "openid4vp": "assurance-input",
    "caep-1.0": "external-security-signals",
    "ietf-token-status-list": "draft-monitored",
    "spiffe": "workload-identity-input",
    "mcp-2026-07-28": "supported-target",
    "c2pa-2.4": "provenance-input"
  },
  "contact": {
    "general": "mailto:hello@worldauth.com",
    "security": "mailto:security@worldauth.com",
    "privacy": "mailto:privacy@worldauth.com",
    "security_policy": "https://worldauth.com/security"
  },
  "human_surfaces": {
    "overview": "https://worldauth.com/",
    "how_it_works": "https://worldauth.com/how",
    "key": "https://worldauth.com/key",
    "gate": "https://worldauth.com/gate",
    "developers": "https://worldauth.com/developers",
    "standards": "https://worldauth.com/standards",
    "security": "https://worldauth.com/security",
    "privacy": "https://worldauth.com/privacy",
    "terms": "https://worldauth.com/terms",
    "company": "https://worldauth.com/company",
    "contact": "https://worldauth.com/contact"
  }
}