# The Register Interface Is A Graph Where Every Edge Carries A Verification Badge: A Policy Is A Query That Must Return Empty, And The Surface Question Fails Because The Vendor Holds The Fact And Does Not Notarise It

**version** v0.33.61
**date** 20 August 2026
**from** Human (project lead)
**to** The pki.sgit.ai site agent, Engineering, Architecture, the nhi.sgit.ai site agent

**type** Dev brief

*Seventh of 20 August, and the second of two documents from one memo at the project lead's own division. The surface question was tested rather than reasoned about, inside a running rented agent session, and the result is reported with what was and was not present. The attestation architecture is checked against published work. Limitation: the vendor's compliance interface is described from a third-party guide rather than from the vendor's own documentation, so its coverage claims should be confirmed before being quoted onward, and the firsthand test covers one surface on one date.*

---

## What This Is

The interface the memo asks for, the primitive that makes it more than a diagram, and a tested answer to the concrete question it poses: **the memo wants the registry rendered as a hyperlinked register showing projects, agents, identities, their histories, the work they have done, and the grants and mandates attached to each, with everything linked and everything verifiable, and it notes that some verifications can be done by a client and some only by a provider; the design primitive that carries all of that is a badge on every edge rather than a page layout, because every line in this interface is a claim by somebody about somebody, and what a reader needs beside each one is who can verify it, by what method, at what cost, when it was last checked and what the answer was, with unknown and unreachable and never-checked as distinct states rather than as blanks; that badge then makes the policy layer expressible, since a policy is a saved query that must return no rows, and whether it is a control or a wish is decided entirely by the badge on the edge it constrains, which is this morning's distinction between enforcement and instrumentation arriving in a user interface; the memo's concrete example asks how you could verify that an agent is running on a particular vendor surface, and that was tested inside a running rented session rather than reasoned about, with the result that the surface is named precisely in the environment by an entrypoint, a remote flag, an environment type, a container identifier, a session identifier and account and organisation identifiers, while no trusted platform module, no virtual equivalent and no enclave attestation device is present and nothing anywhere is signed, so the agent knows its surface and cannot prove it, which is published work's own conclusion that the witness is also the suspect and that proving where software ran requires evidence originating below the software the operator controls; the memo's proposed remedy of handing the session a secret does not close it and makes it worse, because a secret proves possession rather than location and anybody who extracts it presents it from anywhere, which is the bootstrap trap pattern of every workaround handing over a larger identity; and the sharpest finding is that the gap is narrower and more tractable than the research site currently states, because the vendor does record the surface, in a client platform field on an audit feed, and that record is reachable only by the owning organisation, is not signed, and does not cover the surface this memo was processed on at all, so the problem is distribution rather than knowledge and the thing to track is whether any vendor will sign its own record for a named third party.** It is the seventh document of 20 August (cross-ref: the v0.33.61 notary brief, the v0.33.61 grant and mandate brief, the v0.33.61 history brief, the v0.33.59 nhi site brief, and the v0.33.60 bootstrap trap brief). New contributions: **the verification badge as the interface's primitive, the policy expressed as a query that must return empty, the surface question tested firsthand with its negative result recorded, the handed-secret remedy refuted, the gap reframed from knowledge to distribution, and a single dated tripwire proposed for the research site.**

## Every Edge Carries A Badge, And The Badge Is The Design

The memo describes the interface. The project lead: **"the UI that we should have on PKI should be a sort of a hyperlink risk register, where I can then start to represent the projects I'm working on, the agents I'm working on, the identities that exist, the history of those identities, the work they've done, the grants that they have, the grants that have been assigned to a project, the mandates that have been assigned to a project."**

Every one of those is a node, and everything between them is an edge. **The nodes are the easy part.** Any graph browser renders nodes and links, and one that stops there is a diagram of assertions with nothing to distinguish a fact from a rumour.

**Each edge is a claim by somebody about somebody**, and the thing a reader needs is not the claim but its standing. So the primitive is a badge, carried by every edge without exception:

| Field | Values | Why it is separate |
|---|---|---|
| **Claim** | The edge stated in words | So it can be disagreed with |
| **Verifiable by** | Client, provider, or **nobody** | The memo's own distinction, made visible per edge |
| **Method** | Signature check, published statement, live lookup, or none | Decides cost and availability |
| **Cost** | Free, one-off, or metered | A reader deciding whether to check needs to know before clicking |
| **Last checked** | A date, or never | Because this ages, and the corpus dates everything that ages |
| **Result** | Confirmed, denied, unknown, unreachable, not checked | **Five states, and the last three are not the same** |

Two of those rows are the ones that will be dropped and are the reason to write this down.

**Nobody is a legitimate value for verifiable by**, and it is the most informative one on the page. An edge that no party can check is not a broken edge; it is a correctly rendered fact about the world, and hiding it produces an interface where everything looks equally solid.

**And the result column needs five states rather than a tick and a cross.** Denied, unreachable and never checked are three different situations that a two-state badge collapses into one, and the June trust model already treats explicit distrust as a signal rather than an absence. An interface that renders an unreachable authority the same as a hostile one will manufacture incidents.

## A Policy Is A Query That Must Return Empty

The memo adds a layer and is right that it belongs. The project lead: **"we also need to add policies on top of this because policies codify the stuff. So let's say that I have a policy that says I don't want to run any of my computes locally."**

**A policy is a saved query over the register that must return no rows.** That is the whole formulation, and it has three properties worth having.

It is checkable, because running it either returns rows or does not. It is explainable, because the rows it returns are the violations, already hyperlinked to the evidence. And it dates itself, because each returned row carries the badge of the edge that produced it.

The example the memo gives becomes:

```
   POLICY  "no session of mine runs anywhere but surface X"

   QUERY   every session node
             whose surface edge is absent
             or whose surface edge names anything but X

   MUST RETURN  no rows
```

**And the badge on that surface edge decides what the policy is.** This is the point where the interface inherits this morning's strategy brief rather than restating it:

| Badge on the constrained edge | What the policy actually is |
|---|---|
| Verifiable by client, signature check | **Enforcement.** A violation is detectable by anybody |
| Verifiable by provider, live lookup | Enforcement, at the cost of a dependency and a fee |
| **Verifiable by nobody** | **Instrumentation.** The policy records an expectation and detects nothing |

So a policy engine over this register is honest by construction, provided the badge is rendered beside the verdict. **A policy whose constrained edge is unverifiable should say so on its own result page**, in the same words, rather than reporting compliant.

## The Surface Question, Tested Rather Than Reasoned About

The memo asks the question that decides whether that last row is hypothetical. The project lead: **"how can I verify that an agent is running in cloud web? ... How can I today, without me giving anything, provide that? Does Cloud have a way to provide this, or do I need to give a secret?"**

This was tested inside a running rented agent session on 20 August rather than argued from first principles.

**What is present.** The surface is named, precisely and in several ways: an entrypoint variable naming the product surface, a flag marking the session remote, an environment type, a container identifier, a session identifier, and account and organisation identifiers. An agent wanting to report where it is running has everything it needs.

**What is absent.** No trusted platform module, no virtual equivalent, and no enclave attestation device of any kind. Nothing on the filesystem is signed. There is no interface offering a platform-issued statement about the session.

**So the result is precise, and it is negative:**

> The surface is knowable to the agent and unprovable to anybody else. Every identifier is an environment variable, and an environment variable is self-reported, settable by whoever starts the process, and carries no signature. An agent stating its surface produces a claim with exactly the weight of the agent saying so.

That is not a quirk of one platform. Published work composing the internet attestation architecture with agent action records states the general form: every field in such an account is asserted by the same software stack whose integrity is in question, which the authors call the problem of the witness also being the suspect, and it concludes that proving which environment software ran in requires evidence originating below the software the operator controls, rooted in hardware the operator cannot rewrite. That layer is what is missing for hosted and vendor-run agents, and its absence here was directly observed rather than assumed.

**This is the two-populations thesis, demonstrated.** The 16 August research site argues that the industry answers agents you run and not agents you rent, because a rented agent cannot be attested. The test above is that claim reduced to one command and a negative result, on the exact class of agent the site is about.

## Handing The Session A Secret Does Not Close It

The memo offers the obvious remedy and it is worth refuting carefully, because it is what most people will reach for.

**A secret proves possession, not location.**

| What the policy needs to know | What a secret handed to the session establishes |
|---|---|
| This session is running on surface X | **Whoever sent this message holds the secret** |
| The secret has not been copied elsewhere | **Nothing** |
| The platform stands behind the claim | **Nothing. You issued it yourself** |
| It was true at the time of the action | Only that the holder was reachable |

So handing a secret converts an unprovable statement about location into a bearer claim about possession, which answers a different and weaker question. It also fails in the direction this corpus already named on 19 August: **every workaround for the bootstrap problem hands over a larger identity than the one being established.** A credential given to a session so that the session can prove where it is running is a credential that can be exfiltrated and replayed from anywhere, which is worse than the unverified claim it replaced, because the unverified claim was at least visibly unverified.

**What would close it is structurally different.** The platform signs a statement about the session, with a key the platform controls, and a third party verifies it against the platform's published key. The subject is not the signer. That is the same shape as the workflow-identity signing recorded in this morning's register brief, where the continuous integration platform signs and verification reveals which repository and workflow produced the artefact, and it is the notary of the companion brief with the vendor in the notary's chair.

**Nothing the customer can do substitutes for it**, which is worth saying plainly, because the instinct to solve it locally is exactly what produces the over-scoped credentials the corpus has been documenting since 14 August.

## The Fact Exists, The Distribution Does Not

The sharpest finding, and it narrows the problem rather than confirming it.

A third-party guide to the vendor's compliance interface describes an audit event feed of around thirty typed events, each carrying a timestamp, an actor, an event type, an address, a device identifier, a user agent, and **a client platform field**. So the surface is recorded. Somebody knows.

But four properties make that record unusable for the memo's purpose:

| Property | Consequence |
|---|---|
| Reachable only by the owning organisation, on an enterprise tier, enabled by a primary owner | **A relying party cannot ask** |
| Accessed with organisation-scoped administrative keys | Not delegable to a third party without handing over far more |
| **Nothing is signed** | An export is a claim by the account holder about the account holder |
| Coverage is uneven by surface, with the web and interface surfaces covered, the coding surface limited to identity and organisation events, and the cowork surface reported as not covered at all | **The claim cannot even be self-audited for some surfaces** |

**So the gap is not knowledge. It is distribution.** The vendor holds the fact and has no mechanism for telling a third party in a form that third party can check without trusting the account holder.

That is a materially more tractable problem than the one the research site currently describes, and it is a better argument. Attestation from nothing is a hardware problem. **Signing a record you already hold, for a named relying party, is a product decision.**

And one detail belongs in the record because it is checkable and slightly absurd: **the surface on which this memo was processed is the one reported as having no audit coverage at all.** The session that tested the question is invisible to the mechanism that would have answered it.

## What This Sharpens On The Research Site

The 16 August brief asked that the thesis be falsifiable, dated, and re-runnable. This gives it a single tripwire instead of a general claim.

**The claim to publish is narrower and stronger:**

> For agents you rent, the platform knows which surface a session ran on and offers no way to prove it to anybody else. No vendor currently issues a signed, third-party-verifiable statement naming the surface of a session. Anybody who can show one refutes this.

That is one sentence, it is checkable per vendor, it has a date, and it names what would falsify it. It also gives the site a re-run method that costs one search per vendor per quarter rather than an architecture review.

**And it changes what the site should ask vendors for**, which is a more useful output than a comparison table. Not attestation hardware, not a new standard: an endpoint that signs an existing audit record for a named relying party, with the surface field in it.

## Record The Unverifiable Rather Than Omitting It

A rendering rule that follows from all of the above, and it is the corpus's own habit.

An edge reading surface: cowork, verifiable by: nobody, last checked: never **is a finding**, and it is more useful on the page than off it. The alternative designs are both worse: omitting the edge implies the question was not asked, and rendering it without a badge implies it was answered.

This is the gap being the finding, which this corpus has now reached in enough places to be a house rule: unmapped content, disagreeing models, diverging graphs, unanswered questions, searches that returned nothing, and now unverifiable edges. **The register's most valuable page will be the one listing every edge that nobody can check.**

## This Session As A Worked Instance

The memo ends on exactly the position this morning's strategy brief argued, and the session processing it is an instance. The project lead: **"we have to give Claude a grant that is way bigger than I wish I would give. But then I want to give it a mandate, which is exactly what it needs to have."**

Filled in from the environment observed above, for the session that wrote this brief:

| | This session |
|---|---|
| Identity | An account identifier and an organisation identifier, both self-reported by the environment |
| Surface claim | A remote cloud session on the cowork entrypoint. **Verifiable by: nobody** |
| Grant | Read and write across the filesystem, arbitrary command execution, network egress to permitted hosts, a configured version control identity, and delivery of files to the user |
| Mandate | Convert today's voice memos into briefs, verify checkable claims before writing, and correct the memos where they are wrong |
| Excess authority | Every capability in the grant row that the mandate row does not require, which is most of it |
| Accepted by | **Nobody** |

**The measurement this morning's brief proposed is therefore available today**, on this session, without any new instrumentation, and it produces the large uncomfortable number that brief predicted it would produce on every existing deployment including this one.

One caution, carried from the same brief so it is not lost in the demonstration. The memo hopes the agent will respect the mandate or at least report exceeding it. The project lead: **"we want to see if we can actually get Claude to respect, which I believe you should, or at least be able to detect these mandate issues."** That is worth measuring and it measures a cooperative agent. **A mandate honoured by a model is a usability property, not a security boundary**, because ambient authority means an attacker does not need to acquire authority, only to persuade the holder to use what it already has.

## What To Build First

1. **The badge vocabulary**, written down before any page exists: six fields, five result states, and nobody as a first-class value.
2. **One agent node, end to end**, with its identity, its project edge, its grants and its mandate, every edge badged including the ones badged nobody.
3. **The policy as a saved query** returning violations, with the constrained edge's badge shown beside the verdict.
4. **The history view**, which is the path-scoped traversal named in today's history brief and is the same build for both.
5. **Client-side verifications**, since they are free and therefore have no commercial decision blocking them.
6. **Paid lookups last**, because they depend on the notary decision in the companion brief.

The acceptance test, in the discipline used twice today already:

> A reader opens one agent's page and answers, without leaving it: what this agent is, who says so, who checked and when, what it may do, what it was authorised to do, and which of those statements nobody can currently verify.

The last clause is the one that fails first and it is the one the page exists for.

## What This Does Not Try To Be

- **Not a graph visualisation.** The nodes are the easy part; the badge on every edge is the design.
- **Not a claim that policies are enforceable.** A policy over an unverifiable edge is instrumentation and should say so on its own page.
- **Not a general attestation finding.** One surface, one session, one date, and the negative result is reported with what was and was not present.
- **Not a refutation of the research site's thesis.** It narrows it to something more checkable and harder to argue with.
- **Not the notary design.** That is the companion document.

## Honest Tensions

| Tension | Note |
|---------|------|
| Rendering nobody as a badge value | It is the honest state and a register whose most interesting page lists what it cannot verify is a difficult thing to launch |
| A tested negative result | One session on one date is real evidence and it is one harness, and a vendor may ship the missing endpoint next week |
| Distribution rather than knowledge | It is the better argument and it makes the ask depend entirely on a decision by a party with no obligation to make it |
| Policies over unverifiable edges | Recording them is useful and a policy page that reports instrumentation will be read as compliance by somebody skimming |
| Using this session as the worked instance | It is concrete and checkable and it is the authors marking their own homework on their own exposure |
| The badge as an interface primitive | It makes standing visible everywhere and it puts six fields beside every line on a page whose point was to be readable |

## Open Questions

| Question | Notes |
|----------|-------|
| Has any vendor shipped a signed surface claim? | The tripwire, and it needs an owner and a re-run cadence |
| Does the compliance interface's coverage match the third-party description? | Quoted from a guide rather than vendor documentation, and it should be confirmed before being republished |
| What is rendered when an edge has never been checked? | Distinct from unreachable and from denied, and the default will decide how the page reads |
| Where do policies live? | In the register as nodes, or beside it as configuration, and only the first makes them hyperlinkable |
| Can a session prove continuity to itself? | The 19 August persistence question, and a surface claim that cannot outlive a session is weaker still |
| Who owns the badge when an edge is derived? | A path through three vouches has three badges and one conclusion, and the weakest link should govern |

## Relationship To Previous Briefs

| Date | Document | Relationship |
|---|---|---|
| 20 Aug | `v0.33.61__arch-brief__every-trust-edge-is-a-two-way-conversation-notary-specified-in-march-signed-once-against-checked-every-time.md` | The verification modes the badge renders, and the metering decision that gates paid lookups |
| 20 Aug | `v0.33.61__strategy-brief__grant-is-not-the-mandate-the-gap-between-them-is-the-exposure-nobody-accepted.md` | Enforcement against instrumentation, and the excess authority measured here on this session |
| 16 Aug | `v0.33.59__strategy-brief__nhi-site-two-populations-industry-answers-only-agents-you-run.md` | The thesis this tests directly, and the narrower tripwire it produces |
| 19 Aug | `v0.33.60__strategy-brief__bootstrap-trap-every-workaround-hands-over-a-larger-identity.md` | Why handing the session a secret makes the position worse rather than better |
| 20 Aug | `v0.33.61__arch-brief__register-was-designed-in-june-published-keypairs-are-fixtures-not-identities.md` | Workflow identity signing, which is the shape the missing vendor endpoint would take |
| 20 Aug | `v0.33.61__arch-brief__history-is-the-append-only-log-record-stays-clean-objects-are-immutable-and-the-reference-is-not.md` | The path-scoped traversal that the history view of this interface requires |

---

## Key Claims

| # | Claim |
|---|-------|
| 1 | Every line in this interface is a claim, so the design primitive is a badge on each edge rather than a page layout |
| 2 | Nobody is a legitimate and informative value for who can verify an edge |
| 3 | The result needs five states, since denied, unreachable and never checked are three different situations |
| 4 | A policy is a saved query that must return no rows, and its violations are already hyperlinked to their evidence |
| 5 | The badge on the constrained edge decides whether a policy is enforcement or instrumentation |
| 6 | Tested in a running rented session, the surface is named by environment variables and no attestation device of any kind is present |
| 7 | So the surface is knowable to the agent and unprovable to anybody else |
| 8 | Published work states the general form: the witness is the suspect, and proof requires evidence from below the software the operator controls |
| 9 | Handing the session a secret proves possession rather than location and hands over a larger identity |
| 10 | The vendor does record the surface, in a client platform field on an audit feed reachable only by the owning organisation and not signed |
| 11 | So the gap is distribution rather than knowledge, which makes it a product decision rather than a hardware problem |
| 12 | The research site's claim narrows to one dated tripwire: no vendor issues a signed third-party-verifiable statement naming a session's surface |

---

## Sources

- Published work composing the internet remote attestation architecture with agent action evidence, setting out the attester, verifier and relying party roles, stating that every field in a software-only account is asserted by the same software stack whose integrity is in question, describing this as the witness also being the suspect, and concluding that proving which environment software ran in requires evidence originating below the software the operator controls and rooted in hardware the operator cannot rewrite, with that layer absent for hosted and vendor-run agents: https://arxiv.org/html/2608.00801v1
- A third-party guide to the vendor's compliance interface, describing an audit event feed of around thirty typed events each carrying a client platform field alongside actor, address, device and user agent, restricted to enterprise organisations and enabled by a primary owner, accessed with organisation-scoped administrative keys, with no described mechanism for third-party verification or cryptographic signing, and with coverage described as full for the web and interface surfaces, limited to identity and organisation events for the coding surface, and absent for the cowork surface: https://generalanalysis.com/guides/claude-compliance-api
- The environment identifiers present in a running rented agent session, naming the product entrypoint, the remote flag, the environment type, the container identifier, the session identifier and the account and organisation identifiers, together with the absence of any trusted platform module, virtual equivalent or enclave attestation device and the absence of any signed platform statement: measured directly on 20 August 2026, held with the project record

---

This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).