syndicalt/rava

Rava is an authorization protocol, a set of rules and tools for deciding what is and isn't allowed, designed specifically for autonomous software agents, programs that take actions on their own, like booking a flight or making an API call. Traditional auth systems ask who is logged in and then trust that user to do whatever they're permitted. Rava instead asks a narrower question: is this exact signed action, at this exact moment, permitted by an unbroken chain of delegated approvals? The core idea is capabilities, a signed document that says this actor is allowed to perform these specific operations under these constraints. Capabilities can be delegated, passed from one party to another with equal or narrower permissions, never broader. When an agent wants to take an action, it presents the full delegation chain and a signed description of what it's about to do. A verifier checks every link in the chain, confirms the action fits within all the constraints, checks that the action hasn't been seen before, which is replay protection, and checks that no capability has been revoked. If everything passes, it issues a signed receipt as proof. After the action runs, signed attestations can record what actually happened. Rava is written in Rust and uses established cryptographic libraries, it does not invent its own cryptography. The verifier rejects anything malformed, unsigned, expired, replayed, or out of scope. This is a V0 draft reference implementation, suitable for protocol development and review but not yet recommended for production use.