onyx_perm_grant
Mint a signed permission grant (onyx-perm-grant/v0) for an agent: a portable, Ed25519-notarized declaration of the scope it may act within (allowed_actions, allowed_merchants/domains, spend_max_usdc, principal, consent_ref, expires_at). Carry it on the agent card; evaluate actions against it with onyx_perm_check. Facts, not judgments — attests what was declared, not that the grantor holds the authority. (price: $0.00 USDC, tier: free)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| agent | Yes | Who is granted (did:pkh / wallet / agent id) | |
| purpose | No | ||
| principal | No | Who grants the authority (did / email / org) | |
| expires_at | No | Unix time the grant lapses | |
| consent_ref | No | Proof of consent (AP2 mandate id / signature hash) | |
| velocity_max | No | Max number of transacts per window | |
| spend_max_usdc | No | Hard ceiling per action | |
| allowed_actions | No | Subset of ['read', 'verify', 'transact', 'sign', 'negotiate', 'subscribe']; deny-by-default | |
| allowed_domains | No | ||
| spend_window_sec | No | Window length in seconds (default 86400) | |
| allowed_merchants | No | ||
| spend_window_usdc | No | Optional rolling-window aggregate cap | |
| per_counterparty_budget | No | Max aggregate spend per single counterparty per window |