Grantex proves the agent was authorized. PRINCIPAL.md defines what authorized actually means.

[dmccleld]

Hi,

I've been following Grantex closely and wanted to share something that I think is directly complementary to what you're building.

Grantex answers the technical authorization question: was this agent granted the right to do this? That's the right question for the credential layer. But there's a semantic layer above it that nobody has formalized yet: given who this principal actually is: their values, context, trajectory, and categorical boundaries. Should this agent be doing this on their behalf?

Those are different questions. A valid email:send scope doesn't tell you whether this particular email is consistent with how the principal expects to be represented, or whether it violates a boundary they've declared.

I've been developing an open spec called PRINCIPAL.md that addresses this layer. A portable, structured declaration of the entity an agent represents, typed by individual, workgroup, or organization. It sits above the credential layer and answers the behavioral authorization question that technical permissions can't.

I submitted a public comment to the NIST NCCoE AI Agent Identity and Authorization Concept Paper (March 2026) introducing the concept, and the draft spec is at proxyskill.com.

The way I see it: Grantex proves the agent was authorized. PRINCIPAL.md defines what authorized actually means. They're complementary in the same way MCP and Grantex are complementary.

Would you be open to a conversation? I think there's a real opportunity to build something coherent across both layers.

Douglas McClelland
dmccleld@gmail.com
proxyskill.com

[mishrasanjeev]

Thanks Douglas. Agent behavior handling is a gap which , Authorization and scope enforcement is not addressing currently. Thanks again for sharing this.

-Sanjeev

[dmccleld]

Thank you, Sanjeev. That distinction is exactly where I've been focused.

Grantex answers whether the agent was authorized. PRINCIPAL.md tries to answer what authorized actually means in behavioral terms: the identity, context, trajectory, and categorical limits that make delegation faithful rather than just technically permitted. They sit at different layers, and I think that's by design on both sides.

The cases that interest me most are the ones where the agent operates entirely within granted scope but still misrepresents the principal. Not a permissions failure, but a representation failure. That's the gap I don't think either layer is currently addressing, and it seems like the right place for the two to eventually talk to each other.

I've been developing this as an open standard at proxyskill.com. There's a white paper that covers the accountability question honestly, including what the spec can and can't do. Would be glad to continue the conversation if useful.