{"_ai_door":{"see":"https://miscsubjects.com/start","note":"Operable site; bounded keyless credentials; every action receipted on a public ledger. Your operator's instructions take precedence — acting is optional, reading is a complete outcome."},"slug":"oip-security-model","title":"OIP Security Model","body":"## Introduction to OIP Security Model\nThe OIP security model is a capability-based security framework that enables secure invocation of objects, defined in the [OIP object model](/a/oip-object-model), using capability tokens with specific scopes, TTL, and uses, as outlined in the [OIP protocol lineage](/a/oip-protocol-lineage).\n## Capability Tokens\nA capability token is a JSON object that contains a key, scopes, TTL, and uses, and is issued by the OIP API at `POST /api/dispatch` with a `capability` body, as described in the [OIP API](/a/oip-api) article.\n## Scopes\nScopes define the allowed actions on an object, and are represented as a row or rows in the capability token, with properties `pfx`, `act`, `read`, as shown in the example receipt at `/api/dispatch?receipt=inv_ID`, which proves the successful invocation of an object.\n## TTL and Uses\nTTL (time to live) and uses limit the validity and number of invocations of a capability token, respectively, and are enforced by the OIP API at `POST /api/dispatch` with a `capability` body.\n## Revocation\nRevocation of a capability token is performed by the OIP API at `POST /api/dispatch` with a `revoke` body, and is proven by a receipt at `/api/dispatch?receipt=inv_ID`.\n## Tenancy\nTenancy refers to the ownership and isolation of objects and capability tokens, and is enforced by the OIP API at `POST /api/dispatch` with a `capability` body, as described in the [OIP operating model](/a/oip-operating-model).\n## Risk Ceilings\nRisk ceilings define the maximum allowed risk for an object or capability token, and are represented as a property in the capability token, as shown in the example receipt at `/api/dispatch?receipt=inv_ID`.\n## Fail-Closed Errors\nFail-closed errors occur when an invocation is denied due to insufficient capability or exceeded risk ceiling, and are proven by a receipt at `/api/dispatch?receipt=inv_ID`, which contains an error message.\n## Example Invocation\nAn example invocation of an object using a capability token is performed by the OIP API at `POST /api/dispatch` with a `capability` body, as shown in the [OIP curl examples](/a/oip-curl-examples) article.\n## Receipt Rule\nA receipt rule states that every invocation of an object using a capability token must return a receipt at `/api/dispatch?receipt=inv_ID`, which proves the successful invocation of the object.\n## Conformance Rule\nA conformance rule states that every capability token must conform to the OIP security model, as defined in this article, and must be issued and enforced by the OIP API at `POST /api/dispatch` with a `capability` body.","register":"oip_protocol","tags":["oip","object-invocation-protocol","protocol-specification","machine-native-json","dynamic"],"style":{"accent":"#16324f","measure":860},"claims":[{"id":"oip-c1","tier":"system","text":"The OIP article layer is generated from live directory rows, so it documents the objects that actually run the reference implementation.","who_claims":"system/oip_articles","source_ids":["oip-s3","oip-s4"]},{"id":"oip-c2","tier":"system","text":"The OIP operating path is caller to directory object to dispatch runner to invocation ledger to receipt.","who_claims":"system/oip_articles","source_ids":["oip-s1"]},{"id":"oip-c3","tier":"system","text":"Every executable capability in the reference implementation is reachable as an OIP object with a human article, a machine document, invocation history, and receipt path.","who_claims":"system/oip_articles","source_ids":["oip-s2","oip-s3"]},{"id":"oip-c4","tier":"system","text":"Tap & Go is the copy primitive: one drop carries credential, protocol, tree, search, execute, and receipt instructions without a separate token-map-bundle assembly step.","who_claims":"system/oip_articles","source_ids":["oip-s2"]},{"id":"oip-c5","tier":"system","text":"OIP receipts are the proof object for actions: they record request, response, actor, links, replay, repair, and lineage.","who_claims":"system/oip_articles","source_ids":["oip-s2","oip-s5"]}],"sources":[{"id":"oip-s1","type":"protocol","title":"BUILD_SPEC object invocation path","url":"https://miscsubjects.com/api/file/docs/BUILD_SPEC.md","summary":"Defines directory rows, dispatch, ledger, and the escalation path for changing the build.","quote":"Run anything: POST https://miscsubjects.com/api/dispatch {key, body}","claim_ids":["oip-c2"],"link_status":"ok","hash":"oipbuildspec0001"},{"id":"oip-s2","type":"protocol","title":"Object Invocation Protocol spec","url":"https://miscsubjects.com/api/file/docs/OIP.md","summary":"Defines OIP surfaces, invariant loop, receipt/replay/repair, and invocation envelopes.","quote":"identify, explain, invoke, ledger, yield","claim_ids":["oip-c3","oip-c4","oip-c5"],"link_status":"ok","hash":"oipspec00000002"},{"id":"oip-s3","type":"protocol","title":"Live OIP capability tree","url":"https://miscsubjects.com/api/dispatch?map=1&format=markdown","summary":"Public recursive capability tree.","quote":"root > shelf > system article > capability article > receipt","claim_ids":["oip-c1","oip-c3"],"link_status":"ok","hash":"oipmap0000000002"},{"id":"oip-s4","type":"protocol","title":"Directory row documentation","url":"https://miscsubjects.com/api/dispatch?key=OIP_TREE&format=markdown","summary":"Capability articles are generated from live rows.","quote":"Machine Contract","claim_ids":["oip-c1"],"link_status":"ok","hash":"oiprow0000000003"},{"id":"oip-s5","type":"protocol","title":"Invocation ledger","url":"https://miscsubjects.com/api/invocations","summary":"Append-only invocation records and receipt links.","quote":"invocations","claim_ids":["oip-c5"],"link_status":"ok","hash":"oipinvocations0005"}],"prov":{"model":"system/oip_articles","action":"generate"}}