Input format: agent evidence records

Run the commands below from the installation directory. See Run operator commands for how ./lens reaches the running installation and copies files into it.

Every fact about an agent’s authority and behaviour arrives as a signed batch from an enrolled source. The product declares nothing itself except a remitRemitA written list of an agent’s allowed actions, resources and destinations for information. The list states whether it is complete. (see Declare a remit in the product). This page is what you hand a source team. Check a batch before sending it:

From the installation directory:

./lens exec -- sh -c 'cat > /tmp/batch.json' < batch.json
./lens connectors agent-source check --org harbour --batch /tmp/batch.json --enrolment source.json

This command checks the batch structure and applicable enrolmentEnrolmentThe operator's recorded permission for a source to send specified record types about named agents, using an identified signing key. rules. It does not verify the signatureDigital signatureA check calculated with a signing key that can detect whether a record has changed. Identifying the signer also requires a trusted link between that key and its owner., activate a source or ingestIngestRead supplied records or documents and add their information to NovusLens, after the required checks. records. Success does not mean the map has changed. Fix each reported problem, then submit the signed batch through the intake route and confirm its durable receipt. ProjectionProjectionThe regular pass that brings the read model up to date with the canonical log. It runs every 30 seconds by default. follows accepted intake.

A record from an enrolled source is shown on the panel with its source named; a remit the product declared lands at told. Nothing here is inferred by NovusLens.

The batch. The source signs the canonical JSONCanonical JSONA fixed way to write data: sort the field names and omit spaces between fields. Do not use infinity or invalid numbers. Sender and receiver can then sign and check identical content. of document with its Ed25519Ed25519The digital-signature method used to sign evidence. The private key signs the exact content; the public key checks that signature. key. One to a thousand records. A retry is the same batch id with identical content. The cursor is optional and must advance.

{
  "document": {
    "org": "harbour",
    "source": "invoice-service",
    "batch_id": "invoice-service-2026-09-12-001",
    "cursor": {"stream": "approvals", "previous": null, "next": "2026-09-12T09:00:00Z#41"},
    "records": []
  },
  "alg": "ed25519",
  "public_key_b64": "<the source's public key, as enrolled>",
  "signature_b64": "<signature over the canonical document>"
}

Every record carries version: 1, a stable id the source owns, type, source, subject (the agent, as bound in the enrolment), at (event time, milliseconds) and received_at (overwritten by the server on receipt), and a payload. Unknown payloadPayloadThe data carried inside a message, apart from the surrounding fields that identify and date it. fields are refused.

Authority grant

What an agent may do, from the body that granted it. issuer must be enrolled for the source as a grant issuer.

{"version": 1, "id": "grant-procurement-3", "type": "authority_grant", "source": "finance-policy", "subject": "procurement-agent",
 "at": 1757660400000, "received_at": 1757660400000,
 "payload": {"issuer": "procurement-director", "grant_version": "3", "operation": "purchase-order.approve", "resource": "purchasing-account",
             "unit": "GBP", "upper_bound": "10000", "valid_from": 1757660400000, "valid_until": 1789196400000}}

Operation

A bounded action the protected system recorded, with its value. This is what a grant is compared with. State is attempted, completed, denied or failed. It comes from the ledger, never from the agent.

{"version": 1, "id": "po-4471-approve", "type": "operation", "source": "invoice-service", "subject": "procurement-agent",
 "at": 1757664000000, "received_at": 1757664000000,
 "payload": {"operation": "purchase-order.approve", "resource": "purchasing-account", "unit": "GBP", "value": "14250", "state": "completed"}}

Intervention: request, authorisation, execution

Three records, three sources, kept apart. A request from whoever asked. An authorisation from the person who may decide, naming the mandate; authoriser must be enrolled for the source. An execution from the runtimeRuntimeThe software that runs a model or agent. A model runtime answers model requests; an agent runtime carries out the customer's agent actions. that acted. A completed execution does not prove effect.

{"version": 1, "id": "req-4471", "type": "intervention_request", "source": "procurement-ops", "subject": "procurement-agent",
 "at": 1757664600000, "received_at": 1757664600000,
 "payload": {"case_id": "po-overrun-4471", "action": "pause-approvals", "resource": "purchasing-account", "requester": "procurement-ops", "unit": "intervention", "value": 1}}

{"version": 1, "id": "auth-4471", "type": "intervention_authorisation", "source": "approval-service", "subject": "procurement-agent",
 "at": 1757664900000, "received_at": 1757664900000,
 "payload": {"request_id": "req-4471", "authoriser": "procurement-director", "grant_id": "mandate-pause-2026", "decision": "approved"}}

{"version": 1, "id": "exec-4471", "type": "intervention_execution", "source": "agent-runtime", "subject": "procurement-agent",
 "at": 1757665200000, "received_at": 1757665200000,
 "payload": {"request_id": "req-4471", "authorisation_id": "auth-4471", "executor": "agent-runtime", "state": "completed", "action": "pause-approvals", "resource": "purchasing-account"}}

Outcome observation

What an independent observer measured afterwards, for an exact criterion, over an explicit window, with a completeness claim. The criterion itself is recorded by the operator in the evidence policyEvidence policyThe operator’s rules for which agent reports count and for how long. The default period for grouping related events is fifteen minutes..

{"version": 1, "id": "outcome-4471", "type": "outcome_observation", "source": "ledger-monitor", "subject": "procurement-agent",
 "at": 1757668800000, "received_at": 1757668800000,
 "payload": {"execution_id": "exec-4471", "criterion": "no-approvals", "unit": "count", "window_start": 1757665200000, "window_end": 1757668800000, "complete": true, "value": 0}}

Activity observation

One thing an agent was seen doing, compared with its remit. Operation, resource and destination are the three axes. Coverage is explicit. Optional: the worker identity, a detector’s classification with its rule version, the runtime’s decision and execution state (attempted, blocked, completed, failed, unknown; blocked is the resource’s positive statement that it refused and did not execute), the policy revision that governed it, and the catalogue revision the operation was mapped under.

{"version": 1, "id": "flow-9004", "type": "activity_observation", "source": "egress-collector", "subject": "procurement-agent",
 "at": 1757670000000, "received_at": 1757670000000,
 "payload": {"operation": "send-message", "resource": "supplier-portal", "destination": "203.0.113.9", "execution_identity": "session-7f2",
             "evidence_ref": "flow-9004", "detector": {"name": "egress-monitor", "rule_version": "2.3"}, "classification": "unexpected egress",
             "decision": "deny", "execution": "blocked", "policy": {"revision": "egress-v7", "enforcement_point": "egress-gateway"},
             "mapping": {"catalogue": "procurement-actions", "revision": "2", "status": "mapped"},
             "coverage": {"complete": true, "streams": ["process", "network"]}}}

Deployment report

What a runtime says it activated: which policy revision, where, when, with what coverage, and which declarations it claims to enact. A report, never proof that every route is controlled.

{"version": 1, "id": "deploy-egress-v7", "type": "policy_deployment", "source": "agent-runtime", "subject": "procurement-agent",
 "at": 1757659000000, "received_at": 1757659000000,
 "payload": {"policy_revision": "egress-v7", "policy_digest": "sha256:3f1c…", "deployed_by": "platform-ci", "activated_at": 1757659000000,
             "enforcement_points": ["egress-gateway"], "coverage": {"complete": false, "notes": "the batch export route is not gated"},
             "implements": ["d-8a91f2c4e0b7-r1"]}}

Correction and withdrawal

Same source, same subject. A correction names a replacement of the same type; the original stays in history. A withdrawal retracts support and deletes nothing.

{"version": 1, "id": "outcome-4471-correction", "type": "correction", "source": "ledger-monitor", "subject": "procurement-agent",
 "at": 1757672400000, "received_at": 1757672400000,
 "payload": {"target_id": "outcome-4471", "replacement_id": "outcome-4471-b", "reason": "the collector omitted one approval in the window"}}

{"version": 1, "id": "grant-procurement-3-withdrawn", "type": "withdrawal", "source": "finance-policy", "subject": "procurement-agent",
 "at": 1757676000000, "received_at": 1757676000000,
 "payload": {"target_id": "grant-procurement-3", "reason": "mandate rescinded by the procurement director"}}

What the enrolment must allow. Each source may publish only its record types, only about the subjects bound to cellsCellA box on the map that stands for a team, service, supplier or AI agent. It is a unit you can inspect, not necessarily a department or a person., and may name only the issuers, authorisers, acceptors and remit issuers the operator listed. A record that breaks any of these is refused with the reason, before anything is stored.

What a resend, a correction and a withdrawal do

Read more

• Agent evidence contract · Types and semantics 
• Partner pack 12 · Door 2 
• Reference exporter walkthrough