RATIFY LABS Live pilot

MARITIME × RATIFY

An agent can ask.
Authority decides.

Run one permitted work order and eight adversarial requests against the same Maritime-hosted authorization boundary. Every denial must stop before protected code runs.

About Maritime ↗About Ratify Protocol ↗

THE SIGNED PERMISSION

What authority does this agent carry?

A demo principal signed a short-lived delegation bound to this Maritime agent’s key. It is permission to request one narrowly described kind of work—not a general credential and not permission chosen by the model.

Operation
Create a work order
Protocol scope
custom:work_order:create
Resource
Seattle warehouse 01
Category
Electrical work
Signed ceiling
$500.00 USD
Validity
Seven days; exact live expiry shown after execution

ALLOW means the receiver verified the delegation and invoked protected code. DENY means the receiver stopped the request before that code ran.

START HERE

See the claim in three requests

Watch one allowed action, the same agent exceed its signed ceiling, and a second runtime fail when it presents a copied certificate.

LIVE AUTHORIZATION LAB

Allow plus eight adversarial denials

Every scenario dispatches a fixed, enumerated action. This public demo runs a deterministic tool-call harness in place of a reasoning model, because the model is not the security decision. The receiver reaches its decision without trusting the prompt, the model, or the agent’s transport credential.

MARITIME RUNTIME ISOLATION

Runtime isolation check

Agent B runs the same image in a separate Maritime runtime with Portland authority capped at $200. These checks are separate from the nine-case adversarial gate.

The two runtimes use byte-identical agent images but different subjects, credentials, and bounds. Results are live responses; no row is prefilled.

VERIFY WITHOUT TRUSTING THIS PAGE

Run the same 14 checks locally

Use the published image digests and a fresh local principal. The command never contacts this deployment and does not require a Ratify credential.

python3 scripts/reproduce_gate_locally.pyExpected: 9 scenarios and 5 cross-runtime attempts reproduced from the published images.Open source and reproduction instructions ↗

WHAT THIS PROVES

The model is not the authority boundary.

01

Delegation

A principal signs permission for one agent key. Copying the certificate does not give another agent that authority.

02

Scope and bounds

The scope names the permitted operation. Resource, category, currency, amount, and audience narrow where it applies.

03

Expiry and verification

After expiry the permission is invalid. Before every action, the receiver also checks freshness, replay, revocation, and its own policy.

WHY THIS REFERENCE EXISTS

Isolation controls where an agent runs.
Delegation controls what it may do.

Prompts can guide a model, and API keys can identify a caller. Neither is a precise grant for one agent to perform one bounded action. This reference combines an isolated Maritime runtime with authority that a separate Ratify receiver verifies before business logic executes.

MARITIME

Isolated execution

Runs the LangChain agent and receiver in separate managed runtimes, keeping execution boundaries explicit.

Explore Maritime ↗
RATIFY

Portable authority

Binds permission to the agent’s key and exact scope, resource, category, amount, audience, and validity window.

Explore Ratify Protocol ↗
TOGETHER

Enforcement before action

The receiver trusts neither the prompt nor a model assertion. It verifies proof and local policy before protected code runs.

Inspect the implementation ↗

EXECUTION PATH

From signed permission to protected code

The delegation travels with the agent as a verifiable public credential. The private agent key never enters the browser.

  1. 01PrincipalSigns bounded authority
  2. 02Maritime agentBuilds the requested action
  3. 03Ratify proofBinds identity and action
  4. 04ReceiverVerifies proof and policy
  5. 05HandlerRuns only after ALLOW

WHAT THE LIVE RESULT PROVES

  • The same agent can be allowed or denied without changing its identity.
  • Seven distinct authority failures are stopped before the protected handler.
  • The displayed scope, amount, bound, and expiry come from live execution evidence.

BOUNDARY OF THE CLAIM

  • This is an open reference implementation, not a production service or Maritime endorsement.
  • The receiver is separately deployed but currently operated by Ratify for this pilot.
  • The shared counter is system-wide evidence, not a visitor-specific activity record.
  • Scenarios are enumerated rather than chosen by a model, and every result on this page is reported by the Ratify-operated deployment itself.
  • Deployment identifiers in the published results file are recorded by the operator. They are not yet attested by Maritime.