{"ontology":"https://layer.re/machine/schema.json","epistemic_model":"evidence-backed-temporal-layer-graph","canonical":true,"type":"layer_history","layer":{"id":"layer-permissions","slug":"permissions","name":"Permissions","description":"Authorization, delegation and control infrastructure.","machine_description":"Authorization, delegation and control infrastructure.","active":1},"snapshots":[{"id":"state-permissions-2022q1","layer_id":"layer-permissions","as_of":"2022-03-31 23:59:59.000","summary":"The selected Q1 evidence shows API access controls, privacy processes and institutional governance, but not a distinct agent-permission infrastructure for delegated autonomous action.","dependencies":["layer-software","layer-governance"],"constraints":["no standardized delegation semantics evidenced","no agent runtime enforcement layer evidenced"],"emerging_capabilities":[],"underdeveloped_components":["agent-specific authorization","portable delegated permissions","runtime policy enforcement"],"uncertainties":["general computing permissions existed, but their later agent-layer significance should not be projected backward"],"confidence":0.72,"previous_snapshot_id":null,"mapping_mode":"retrospective","reconstructed_at":"2026-10-01T17:34:32.000Z","created_at":"2026-10-01T18:05:36.398Z","updated_at":"2026-10-01T18:05:36.398Z"},{"id":"state-permissions-2025q2","layer_id":"layer-permissions","as_of":"2025-06-30 23:59:59.000","summary":"This period adds specific permissions evidence through Visa introduces Intelligent Commerce; Codex cloud research preview launches; Microsoft announces Entra Agent ID preview. Maturity remains specific to the cited products and programs; this synthesis does not infer sector-wide adoption.","dependencies":[],"constraints":["An announced program does not establish widespread production agent payments.","Research preview access and selected demonstrations do not establish reliable autonomous software delivery.","Preview identity management does not imply production-wide adoption or universal independent agent principals."],"emerging_capabilities":["Visa introduces Intelligent Commerce","Codex cloud research preview launches","Microsoft announces Entra Agent ID preview"],"underdeveloped_components":["Independent measurement of deployment scope and outcomes"],"uncertainties":["No verified earlier state is available in the supplied historical chain; null does not assert the layer began in this period."],"confidence":0.9,"previous_snapshot_id":null,"mapping_mode":"retrospective","reconstructed_at":"2026-10-10T06:24:42.000Z","created_at":"2026-10-10T08:25:19.367Z","updated_at":"2026-10-10T08:25:19.367Z"},{"id":"state-permissions-2025q3","layer_id":"layer-permissions","as_of":"2025-09-30 23:59:59.000","summary":"This period adds specific permissions evidence through ChatGPT agent starts paid-user rollout; AP2 agent payment protocol is announced; Instant Checkout launches with an Agentic Commerce Protocol. Maturity remains specific to the cited products and programs; this synthesis does not infer sector-wide adoption.","dependencies":[],"constraints":["Bounded tasks and staged rollout do not establish persistent always-on agents or unrestricted permissions.","Protocol support does not confer bank permissions or prove broad live transaction adoption.","Merchant expansion is prospective and checkout still requires user confirmation using existing payment infrastructure."],"emerging_capabilities":["ChatGPT agent starts paid-user rollout","AP2 agent payment protocol is announced","Instant Checkout launches with an Agentic Commerce Protocol"],"underdeveloped_components":["Independent measurement of deployment scope and outcomes"],"uncertainties":["The referenced historical predecessor belongs to the reviewed chronology; the live history must be checked before ingestion."],"confidence":0.9,"previous_snapshot_id":"state-permissions-2025q2","mapping_mode":"retrospective","reconstructed_at":"2026-10-10T06:24:42.000Z","created_at":"2026-10-10T08:31:22.794Z","updated_at":"2026-10-10T08:31:22.794Z"},{"id":"state-permissions-2025q4","layer_id":"layer-permissions","as_of":"2025-12-31 23:59:59.000","summary":"This period adds specific permissions evidence through Codex reaches general availability; Anthropic introduces Agent Skills. Maturity remains specific to the cited products and programs; this synthesis does not infer sector-wide adoption.","dependencies":[],"constraints":["Tool availability does not remove review requirements or establish universal autonomous engineering.","Loading procedural knowledge is not evidence that embedded scripts are safe or universally portable."],"emerging_capabilities":["Codex reaches general availability","Anthropic introduces Agent Skills"],"underdeveloped_components":["Independent measurement of deployment scope and outcomes"],"uncertainties":["The referenced historical predecessor belongs to the reviewed chronology; the live history must be checked before ingestion."],"confidence":0.9,"previous_snapshot_id":"state-permissions-2025q3","mapping_mode":"retrospective","reconstructed_at":"2026-10-10T06:24:42.000Z","created_at":"2026-10-10T08:37:10.930Z","updated_at":"2026-10-10T08:37:10.930Z"},{"id":"state-permissions-2026q1","layer_id":"layer-permissions","as_of":"2026-03-31 23:59:59.000","summary":"This period adds specific permissions evidence through Codex desktop app launches on macOS; GPT-5.4 adds native computer use and tool search. Maturity remains specific to the cited products and programs; this synthesis does not infer sector-wide adoption.","dependencies":[],"constraints":["The March Windows update is separate; long-running workflow claims do not quantify independent reliability.","Model capability does not grant permissions or independently establish safe end-to-end task completion."],"emerging_capabilities":["Codex desktop app launches on macOS","GPT-5.4 adds native computer use and tool search"],"underdeveloped_components":["Independent measurement of deployment scope and outcomes"],"uncertainties":["The referenced historical predecessor belongs to the reviewed chronology; the live history must be checked before ingestion."],"confidence":0.9,"previous_snapshot_id":"state-permissions-2025q4","mapping_mode":"retrospective","reconstructed_at":"2026-10-10T06:24:42.000Z","created_at":"2026-10-10T08:45:32.712Z","updated_at":"2026-10-10T08:45:32.712Z"},{"id":"state-permissions-2026q2","layer_id":"layer-permissions","as_of":"2026-06-30 23:59:59.000","summary":"This period adds specific permissions evidence through AP2 moves to FIDO and adds delegated payment support; Google makes agents first-class identity principals; Worldline ING and Mastercard report live agent payment. Maturity remains specific to the cited products and programs; this synthesis does not infer sector-wide adoption.","dependencies":[],"constraints":["Preauthorization mechanisms do not imply unbounded authority or universal merchant and issuer adoption.","Agent Runtime identity availability must not be conflated with preview platform and auth-manager components.","First-of-kind language is an actor claim; one reported transaction does not establish mass adoption."],"emerging_capabilities":["AP2 moves to FIDO and adds delegated payment support","Google makes agents first-class identity principals","Worldline ING and Mastercard report live agent payment"],"underdeveloped_components":["Independent measurement of deployment scope and outcomes"],"uncertainties":["The referenced historical predecessor belongs to the reviewed chronology; the live history must be checked before ingestion."],"confidence":0.9,"previous_snapshot_id":"state-permissions-2026q1","mapping_mode":"retrospective","reconstructed_at":"2026-10-10T06:24:42.000Z","created_at":"2026-10-10T09:06:48.256Z","updated_at":"2026-10-10T09:06:48.256Z"},{"id":"state-permissions-20260930-initial","layer_id":"layer-permissions","as_of":"2026-09-30 12:45:00.000","summary":"Permissions are emerging as an explicit layer around agents, with policy enforcement moving outside the model process and into runtime and hardware controls.","dependencies":["layer-identity","layer-software","layer-chips"],"constraints":["fragmented standards","deployment complexity","cross-vendor interoperability"],"emerging_capabilities":["default-deny agent sandboxes","out-of-band enforcement","auditable tool and data access"],"underdeveloped_components":["shared permission semantics across agent ecosystems"],"uncertainties":["which controls become interoperable standards"],"confidence":0.95,"previous_snapshot_id":null,"mapping_mode":"contemporaneous","reconstructed_at":null,"created_at":"2026-09-30T12:54:32.491Z","updated_at":"2026-09-30T12:54:32.491Z"},{"id":"state-permissions-2026q3","layer_id":"layer-permissions","as_of":"2026-09-30 23:59:59.000","summary":"Runtime identity, delegated approval and software or hardware isolation become distinct control surfaces around capable agents.","dependencies":[],"constraints":["GA is a product status, not evidence of universal identity federation or adoption.","The September 3 entry explicitly says Astra is not yet generally available; later rollout must not be backdated.","Confidential-computing enhancements announced for later are not established launch capabilities.","Reference architecture does not establish broad hardware deployment or invulnerable permission enforcement.","Rollout is gradual and geographically restricted; product claims do not independently prove reliable continuous operation."],"emerging_capabilities":["Agent Identity APIs and auth manager reach GA","GPT-6 Astra begins limited organizational rollout","Meta introduces Muse personal agent","NVIDIA introduces Open Agent Safety Platform","Dots introduces persistent agents with cloud computers"],"underdeveloped_components":["Independent measurement of deployment scope and outcomes"],"uncertainties":["The referenced historical predecessor belongs to the reviewed chronology; the live history must be checked before ingestion."],"confidence":0.9,"previous_snapshot_id":"state-permissions-2026q2","mapping_mode":"retrospective","reconstructed_at":"2026-10-10T06:24:42.000Z","created_at":"2026-10-10T09:18:22.070Z","updated_at":"2026-10-10T09:18:22.070Z"},{"id":"state-permissions-20261001-human-context","layer_id":"layer-permissions","as_of":"2026-10-01 19:31:00.000","summary":"Permission systems are expanding beyond tool and action authorization toward governing which personal context an agent may retrieve, retain, update, infer and reuse.","dependencies":["layer-identity","layer-software","layer-agents","layer-human"],"constraints":["fragmented standards","revocation semantics","cross-vendor interoperability"],"emerging_capabilities":["scoped context access","revocable context grants","permissioned personal-memory retrieval"],"underdeveloped_components":["shared permission semantics for portable human context"],"uncertainties":["which context-control mechanisms become interoperable standards"],"confidence":0.91,"previous_snapshot_id":"state-permissions-20260930-initial","mapping_mode":"contemporaneous","reconstructed_at":null,"created_at":"2026-10-01T20:08:12.917Z","updated_at":"2026-10-01T20:08:12.917Z"},{"id":"state-permissions-20261002-agentic","layer_id":"layer-permissions","as_of":"2026-10-02 07:22:00.000","summary":"Permission systems are increasingly governing both data/tool access and consequential delegated actions, with approvals, scoped authority and least-privilege controls becoming explicit across agent and payment infrastructure.","dependencies":["layer-identity","layer-agents","layer-payments","layer-software"],"constraints":["fragmented semantics","revocation","cross-vendor interoperability"],"emerging_capabilities":["scoped delegated authority","consequential-action confirmations","least-privilege agent credentials"],"underdeveloped_components":["shared permission semantics across agent ecosystems"],"uncertainties":["which controls become interoperable standards"],"confidence":0.95,"previous_snapshot_id":null,"mapping_mode":"contemporaneous","reconstructed_at":null,"created_at":"2026-10-02T09:22:12.384Z","updated_at":"2026-10-02T09:22:12.384Z"},{"id":"state-permissions-20261004-agent-app-context","layer_id":"layer-permissions","as_of":"2026-10-04 21:50:08.000","summary":"Permission systems are increasingly being reused as the boundary around agent-accessible application capabilities. Supabase MCP adds concrete implementation evidence for agents acting within a signed-in user's authorization context, while exact scope, revocation and production-security behavior still require deeper verification.","dependencies":["layer-identity","layer-agents","layer-software","layer-human"],"constraints":["fragmented semantics","revocation","cross-vendor interoperability","production security validation"],"emerging_capabilities":["user-context-bound agent actions","application capability exposure through MCP"],"underdeveloped_components":["shared permission semantics across agent ecosystems","portable revocation and audit behavior"],"uncertainties":["how tightly real implementations constrain agent authority","whether these patterns become interoperable standards"],"confidence":0.9,"previous_snapshot_id":null,"mapping_mode":"contemporaneous","reconstructed_at":null,"created_at":"2026-10-04T21:57:54.260Z","updated_at":"2026-10-04T21:57:54.260Z"},{"id":"state-permissions-20261007-runtime-gateways","layer_id":"layer-permissions","as_of":"2026-10-07 00:05:49.000","summary":"Permission systems are expanding from application-context authorization toward action-time gateway enforcement for agents. PlainID provides implementation evidence for binding human and agent identity and controlling tool visibility, invocation, parameters and data at API/AI/MCP gateways, while adoption, interoperability and bypass resistance remain unverified.","dependencies":["layer-identity","layer-agents","layer-software","layer-human"],"constraints":["vendor-specific implementation","adoption unknown","cross-gateway interoperability","policy-bypass resistance","revocation and audit portability"],"emerging_capabilities":["action-time agent authorization at shared gateways","human-to-agent identity binding","tool and parameter-level runtime controls"],"underdeveloped_components":["cross-vendor enforcement semantics","independent security validation","portable audit and revocation behavior"],"uncertainties":["how completely gateway policy constrains agent authority","whether this pattern converges across providers"],"confidence":0.91,"previous_snapshot_id":"state-permissions-20261004-agent-app-context","mapping_mode":"contemporaneous","reconstructed_at":null,"created_at":"2026-10-07T06:53:49.376Z","updated_at":"2026-10-07T06:53:49.376Z"},{"id":"state-permissions-20261008-agent-control-plane","layer_id":"layer-permissions","as_of":"2026-10-08 19:29:00.000","summary":"Permission systems now have stronger hyperscaler evidence of an integrated agent control plane. Google combines agent-specific principals, allow/deny IAM policy, GA authentication brokering, scoped organizational access, per-agent audit attribution, gateway enforcement and sandbox boundaries. This strengthens the existing runtime-gateway pattern without establishing universal, portable delegated-permission semantics or independently proven bypass resistance.","dependencies":["layer-identity","layer-agents","layer-software","layer-human"],"constraints":["provider-specific semantics","cross-system delegation","revocation portability","policy-bypass resistance","independent security validation"],"emerging_capabilities":["agent-specific least-privilege policy","credential brokering for external tools","per-agent audit attribution","scoped coworker-agent access","gateway and sandbox enforcement"],"underdeveloped_components":["cross-provider delegated authorization standards","portable revocation and audit semantics","independent bypass testing"],"uncertainties":["how consistently policies propagate across third-party systems","real-world enforcement robustness under adversarial conditions"],"confidence":0.96,"previous_snapshot_id":"state-permissions-20261007-runtime-gateways","mapping_mode":"contemporaneous","reconstructed_at":null,"created_at":"2026-10-08T20:03:28.741Z","updated_at":"2026-10-08T20:03:28.741Z"}]}