We've published a small, MIT, zero-dependency OWS policy executable that gates signing on a signed, revocable, scope-limited delegation credential. It's for agent wallets that need to prove who authorized an action, and for what scope, before a transaction is signed.
It slots into the existing custom-executable policy flow (stdin PolicyContext, stdout {allow, reason}, fail-closed within the 5s budget). On a deny, the HKDF key is never derived, so the authorization check sits ahead of any key material, exactly where the policy engine already gates.
What it verifies, from the signed payload, with no caller-supplied trust: W3C Data Integrity proof (eddsa-jcs-2022), issuer pinned via did:web with a hard assertionMethod requirement, schema allowlist, validity window, and Bitstring Status List revocation when the credential carries credentialStatus (refresh-first, bounded staleness, fail-closed). Transaction-plane enforcement is derived from the actual raw_hex: amount ceilings, counterparty allow/block lists, time windows. EVM (native + ERC-20 + EIP-3009, the x402 path) and Solana (SOL + SPL TransferChecked, legacy and v0 message formats; v0 transactions using address lookup tables deny fail-closed, since their addresses can't be proven from the static message) are enforced; other rails are verified-identity-only for now. The README's support matrix is the contract: nothing is claimed that a fixture doesn't prove.
Try it in two minutes: clone the repo, npm install, then npm run livefire spins up a sandboxed OWS v1.3.2 install and shows a real POLICY_DENIED on an over-ceiling transaction, then a real signature on a conformant one. We built against released v1.3.2 behavior (the engine passes the full serialized tx as raw_hex on both EVM and Solana, which differs from current docs).
Repo:
github.com/observer-protocol/ows-op-policy
It stands alone with no special access required; happy to contribute upstream if that's ever useful.
We've published a small, MIT, zero-dependency OWS policy executable that gates signing on a signed, revocable, scope-limited delegation credential. It's for agent wallets that need to prove who authorized an action, and for what scope, before a transaction is signed.
It slots into the existing custom-executable policy flow (stdin PolicyContext, stdout {allow, reason}, fail-closed within the 5s budget). On a deny, the HKDF key is never derived, so the authorization check sits ahead of any key material, exactly where the policy engine already gates.
What it verifies, from the signed payload, with no caller-supplied trust: W3C Data Integrity proof (eddsa-jcs-2022), issuer pinned via did:web with a hard assertionMethod requirement, schema allowlist, validity window, and Bitstring Status List revocation when the credential carries credentialStatus (refresh-first, bounded staleness, fail-closed). Transaction-plane enforcement is derived from the actual raw_hex: amount ceilings, counterparty allow/block lists, time windows. EVM (native + ERC-20 + EIP-3009, the x402 path) and Solana (SOL + SPL TransferChecked, legacy and v0 message formats; v0 transactions using address lookup tables deny fail-closed, since their addresses can't be proven from the static message) are enforced; other rails are verified-identity-only for now. The README's support matrix is the contract: nothing is claimed that a fixture doesn't prove.
Try it in two minutes: clone the repo, npm install, then npm run livefire spins up a sandboxed OWS v1.3.2 install and shows a real POLICY_DENIED on an over-ceiling transaction, then a real signature on a conformant one. We built against released v1.3.2 behavior (the engine passes the full serialized tx as raw_hex on both EVM and Solana, which differs from current docs).
Repo:
github.com/observer-protocol/ows-op-policy
It stands alone with no special access required; happy to contribute upstream if that's ever useful.