Following up on @imran-siddique's proposal in cosai-oasis/ws4-secure-design-agentic-systems#149 (2026-07-31 comment). Claiming this slot — unclaimed as of this writing — because the WS4/agent-manifest coevolution now has a concrete technical hook, not just a conceptual boundary.
The bridge: #99 asks "what does a credential assert?" and #149 asks "what does a manifest bind?" Between them sits a question neither answers alone: when is an agent's state trustworthy enough to assert as a claim in the first place?
OCSF's stop_reason_id (ocsf/ocsf-schema#1704, ai_operation profile, still open) answers that. Its values — Stop(1), Length(2), Tool Use(3), Session Stop(4) — carry an explicit semantic split added during review: after a defined stop, the agent's state at that boundary is known and reclaimable; after Unknown, it isn't. That's the leading-indicator use the enum was built for.
Tool Use is the case that matters here: it's the exact moment a credential-gated access decision has to happen, and it's a defined stop boundary — precisely where a signed state snapshot is legitimate to produce, not an arbitrary mid-decode point. That mechanism already exists: rabbidave/ws4-secure-design-agentic-systems@1e35ab5 emits an OCSF ai_agent object with a kv_state_fingerprint and an OAuth-bound token_fingerprint, correlated to a Manifest via ai_agent.instance_uid (the correlation this repo's companion spec_change issue proposes formally).
Put together: a Tool Use stop fires → agent-state emits a signed, instance_uid-correlated state fingerprint at that exact boundary → that fingerprint is the claim a #99 credential presents for the access decision the stop just triggered. Not "trust me" — "here is the signed state, at the one moment OCSF already defines as knowable, correlated to a manifest you can independently verify."
Proposed doc: docs/integrations/agent-credentials.md, following this repo's existing agt.md convention (division-of-concerns table + numbered integration points with code):
- What a credential asserts vs. what a manifest binds
stop_reason_id as trigger — why Tool Use/Session Stop are valid signed-state boundaries, Unknown isn't- Digest-as-claim:
ai_agent.instance_uid (manifest correlation) + kv_state_fingerprint (state-at-stop) as the two values a credential carries
- Explicit non-coverage: doesn't make every stop attestable, doesn't replace boot-time
fields_verified checks, takes no position on Unknown-boundary state
Co-authorship, per Imran's ask: @imolloy and the #99 authors (@benhylau, @ksingh299, @akolekar-zs, @rithikha).
Happy to take the first pass since the mechanism already exists in working code — flagging scope here first, per Imran's preference for contesting scope before a draft goes up rather than after.
Following up on @imran-siddique's proposal in cosai-oasis/ws4-secure-design-agentic-systems#149 (2026-07-31 comment). Claiming this slot — unclaimed as of this writing — because the WS4/agent-manifest coevolution now has a concrete technical hook, not just a conceptual boundary.
The bridge: #99 asks "what does a credential assert?" and #149 asks "what does a manifest bind?" Between them sits a question neither answers alone: when is an agent's state trustworthy enough to assert as a claim in the first place?
OCSF's
stop_reason_id(ocsf/ocsf-schema#1704,ai_operationprofile, still open) answers that. Its values —Stop(1),Length(2),Tool Use(3),Session Stop(4) — carry an explicit semantic split added during review: after a defined stop, the agent's state at that boundary is known and reclaimable; afterUnknown, it isn't. That's the leading-indicator use the enum was built for.Tool Useis the case that matters here: it's the exact moment a credential-gated access decision has to happen, and it's a defined stop boundary — precisely where a signed state snapshot is legitimate to produce, not an arbitrary mid-decode point. That mechanism already exists: rabbidave/ws4-secure-design-agentic-systems@1e35ab5 emits an OCSFai_agentobject with akv_state_fingerprintand an OAuth-boundtoken_fingerprint, correlated to a Manifest viaai_agent.instance_uid(the correlation this repo's companionspec_changeissue proposes formally).Put together: a
Tool Usestop fires → agent-state emits a signed,instance_uid-correlated state fingerprint at that exact boundary → that fingerprint is the claim a #99 credential presents for the access decision the stop just triggered. Not "trust me" — "here is the signed state, at the one moment OCSF already defines as knowable, correlated to a manifest you can independently verify."Proposed doc:
docs/integrations/agent-credentials.md, following this repo's existingagt.mdconvention (division-of-concerns table + numbered integration points with code):stop_reason_idas trigger — whyTool Use/Session Stopare valid signed-state boundaries,Unknownisn'tai_agent.instance_uid(manifest correlation) +kv_state_fingerprint(state-at-stop) as the two values a credential carriesfields_verifiedchecks, takes no position onUnknown-boundary stateCo-authorship, per Imran's ask: @imolloy and the #99 authors (@benhylau, @ksingh299, @akolekar-zs, @rithikha).
Happy to take the first pass since the mechanism already exists in working code — flagging scope here first, per Imran's preference for contesting scope before a draft goes up rather than after.