How does Per-Call Proof for Local Tool Invocation by AI Agents compare to other permit protocols?

Per-Call Proof for Local Tool Invocation by AI Agents is one of 28 standards at step 3, Permit (What may the agent do here?). It pairs with Model Context Protocol, WIMSE AI Identity Management System. It builds on Model Context Protocol. Every standard at this step is listed at https://agenticweb.wiki/category/permit/.

Per-Call Proof for Local Tool Invocation by AI Agents

3 · Permit

Candidate · auto-drafted, unreviewed · confidence 80%

Per-Call Proof for Local Tool Invocation by AI Agents
Category	Permit
Governed by	IETF Internet-Draft, discussed on the WIMSE Working Group mailing list
Status	Internet-Draft, Intended Status: Standards Track; expires 15 April 2027
Phase	draft
Implementation	unknown
Adoption	unmeasured
Version	draft-lee-wimse-local-tool-call-proof-01 (2026-10-12)
Specification	https://datatracker.ietf.org/doc/html/draft-lee-wimse-local-tool-call-proof-01
Found at	Local Call Authority exposes a JSON-RPC 2.0 interface over a Unix domain socket or named pipe on the host; no network discovery described in the available text
Last checked	2026-10-19
Freshness	current · checked 2026-10-19
Solves	Delegate a user's authority to an agent, Audit what an agent did, Expose tools to agents

Per-Call Proof for Local Tool Invocation by AI Agents is an agentic-web standard (endpoint) at step 3, Permit, governed by IETF Internet-Draft, discussed on the WIMSE Working Group mailing list; its own status is "Internet-Draft, Intended Status: Standards Track; expires 15 April 2027" (draft). It answers: How can a local tool server (for example an MCP stdio server) verify that each invocation from an AI agent passed a policy decision, without reusable credentials in the agent process? Adoption is unmeasured, last verified 2026-10-19.

Permit Defines a per-call proof for local tool invocations by AI agents, such as MCP servers over stdio. A Call Authority running outside the agent process evaluates policy, issues a short-lived single-use proof bound to a canonical action digest of the method, tool name and arguments, and verifies it for the tool server. Proof formats are opaque and defined by evidence type profiles. An MCP stdio binding is included. It does not prevent prompt injection, but confines the effects of a compromised agent to actions policy permits.

Discovery and probe

Local Call Authority exposes a JSON-RPC 2.0 interface over a Unix domain socket or named pipe on the host; no network discovery described in the available text

NONE 
parse:     
on absent: Support is a host-local deployment property and cannot be observed from outside the host

Not probed live: no-fixed-path. candidate record; probe rule pending

History

2026-10-19 — auto-drafted candidate from exa (https://datatracker.ietf.org/doc/html/draft-lee-wimse-local-tool-call-proof-01)

Instances

No instances recorded yet.

References

The draft defines a per-call proof for local tool invocation: a Call Authority outside the agent process issues short-lived, single-use proofs bound to the tool name and arguments through a canonical action digest (JCS + SHA-256), and the tool server rejects invocations lacking a valid proof. It includes an MCP stdio binding. — https://datatracker.ietf.org/doc/html/draft-lee-wimse-local-tool-call-proof-01 (2026-10-12) REPORTED

JSON · Markdown