When it fits
- An application admits authenticated machine requests.
Proposed guarantees
These describe the intended contract. Consult implementation and verification evidence before relying on them.
- Stable owner/resource binding
- Hashed secret verification
- Explicit expiry and revocation
What stays outside
- General authorization engine
- Browser-publishable key model
Failure modes
- Cross-owner access
- Revoked credential accepted
- Secret disclosed in logs
Existing alternatives
Go crypto/rand
Use standard cryptography; AMSL may own the lifecycle integration.
Implementations
No AMSL implementation is recorded in this snapshot. External alternatives above are not claims of AMSL adoption.
Evidence and verification
Candidate selection includes restricted, maintainer-reported evidence. It is not independently reproducible here, and no private source details are published.
No executed verification or real consumer adoption is recorded in this snapshot.
Open questions
- Set storage atomicity, account-status and scope-checking contracts.