Full Mission Lifecycle (End-to-End)
The complete mission lifecycle in a four-party federated deployment, from PS discovery through resource access. Mission approval requires user interaction — the PS returns 202 with an interaction URL so the user can review the description and tools. Once approved, the s256 mission fingerprint flows unchanged through every token and header: proposal → AAuth-Mission → resource token (aud=AS) → auth token (iss=AS) → final access check.
Agent fetches PS well-known metadata to discover the mission_endpoint.
mission_endpoint is where the agent POSTs mission proposals for approval.
Step 1: Discover PS metadata
Description (Markdown)
# Analyze Q2 Customer Feedback Read customer feedback records and produce a summary report with sentiment analysis and key themes.
Structured Fields
Approved Tools
Read customer feedback records
Write the summary report to the shared drive
PS Capabilities
R9kNpXeErMQ1Jvk_vxYUp3YEdggmvUhksWtjXtcmnh0
On approval, PS computes SHA-256(approved_blob_bytes) = s256.
R9kNpXeErMQ1Jvk_vxYUp3YEdggmvUhksWtjXtcmnh0
User approves at PS; PS returns the blob + AAuth-Mission header carrying s256.
R9kNpXeErMQ1Jvk_vxYUp3YEdggmvUhksWtjXtcmnh0
Resource embeds the same s256 in the resource token it issues for proactive authorization.
R9kNpXeErMQ1Jvk_vxYUp3YEdggmvUhksWtjXtcmnh0
The Access Server preserves mission.s256 in the auth token after federation.
R9kNpXeErMQ1Jvk_vxYUp3YEdggmvUhksWtjXtcmnh0
Resource compares AAuth-Mission s256 with auth token mission.s256 — end-to-end chain verified.
ps.example