Governed MCP retrieval and release-flow guide

Synthetic worked example

Bind machine identity to a narrow entitlement

What must an evidence-retrieval credential be allowed to do?

A credential, client, grant, plan, tool, validity window, and quota are bound into one immutable grant snapshot.

Starting inputs

A verified client identity

A non-secret credential identifier

One evidence-retrieval plan

A bounded validity interval

Ordered execution

Work the example

  1. 1

    Authenticate the credential outside tool arguments.

  2. 2

    Resolve its client and active grant.

  3. 3

    Match the grant to the exact tool name.

  4. 4

    Check validity window and quota.

  5. 5

    Bind the terms digest into the grant snapshot.

Expected outputs

  • An exact capability decision
  • A quota-bearing grant identity
  • No evidence output before authorization

Verification checks

  • The terms digest matches the public contract.
  • The credential is represented only by identifier or fingerprint.
  • Expired or revoked grants refuse.

Fail closed

Refusal conditions

  • Credential and grant belong to different clients.
  • The tool is absent from allowedTools.
  • A raw credential appears in a receipt.

Digest-bound public fixture

Check the expected state

This fixture contains synthetic operational fields only. Its digest establishes fixture integrity, not scientific truth or a completed commercial transaction.

{
  "artifactKind": "licensed-delivery",
  "schemaVersion": "maha-licensed-evidence/1.0",
  "input": {
    "planId": "evidence-developer-v1",
    "allowedTools": [
      "evidence.retrieve_released_record"
    ],
    "termsSha256": "sha256:5c50f6b36dd890ff4d115c22fd0279df19bfba040d8695942aa7ab24c5085c7b"
  },
  "expected": {
    "monthlyQuotaUnits": 10000,
    "runtimeState": "private"
  },
  "artifactSha256": "sha256:5c71dc0a60cbb260767546e6b61e102b7fdc8723dbca85b991185b0b1936d787"
}