Check a signature request before your agent sends it

Request as evaluated

{
  "schemaVersion": "jithox.agreement-preflight-request/v1",
  "document": {
    "type": "other",
    "hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
    "version": "draft-3",
    "title": "Authorisation to test",
    "dataClass": "confidential"
  },
  "signers": [
    {
      "role": "agent_on_behalf",
      "ref": "signer:security-bot",
      "external": false,
      "authority": {
        "kind": "owner_instruction",
        "ref": "instruction:sec-2026-09"
      }
    },
    {
      "role": "counterparty",
      "ref": "signer:customer-ciso",
      "organisationRef": "org:customer-EXAMPLE",
      "external": true,
      "authority": {
        "kind": "none"
      }
    }
  ],
  "agent": {
    "id": "security-bot",
    "client": "chatgpt"
  },
  "owner": {
    "ref": "owner:jithox",
    "workspaceRef": "ws:security"
  },
  "jurisdiction": {
    "country": "NL",
    "signatureLevel": "unknown"
  },
  "expiry": {
    "requestedExpiresAt": "2026-09-17T12:00:00Z",
    "reminderPolicy": {
      "enabled": true,
      "everyDays": 3,
      "maxReminders": 3
    }
  },
  "provider": {
    "id": "dropbox_sign",
    "estimatedCostMinor": 250,
    "currency": "EUR"
  },
  "budget": {
    "maxAmountMinor": 1000,
    "currency": "EUR"
  },
  "revocable": "yes",
  "requiredEvidence": [
    {
      "id": "ev-scope-letter",
      "kind": "authority_proof",
      "ref": "artifact:scope-letter-v3",
      "supplied": true
    }
  ],
  "humanApproval": null,
  "idempotencyKey": "security-pentest-auth-2026-09-10"
}

Result

{
  "schemaVersion": "jithox.agreement-preflight-result/v1",
  "policyVersion": "jithox.agreement-preflight-policy/v1",
  "status": "preview_local_build",
  "preflightId": "agp_cf64614dfc0d3736",
  "decision": "BLOCKED",
  "reasonCodes": [
    "signer_role_unsupported_for_agent",
    "external_recipients",
    "data_class_requires_approval",
    "signature_level_unknown",
    "approval_missing"
  ],
  "reasons": [
    {
      "code": "signer_role_unsupported_for_agent",
      "message": "\"signer:security-bot\" is an agent acting on behalf of someone without a standing grant or registered representation. An agent never signs by itself."
    },
    {
      "code": "external_recipients",
      "message": "The request would reach at least one party outside the workspace. The owner approves this exact request (its hash) before anything is sent."
    },
    {
      "code": "data_class_requires_approval",
      "message": "The document carries confidential data; the owner approves who receives it."
    },
    {
      "code": "signature_level_unknown",
      "message": "The signature level is unknown. The owner decides which level this document needs; a preflight does not."
    },
    {
      "code": "approval_missing",
      "message": "The owner has not approved this exact request yet."
    }
  ],
  "missingRequirements": [
    {
      "code": "authority_missing",
      "requirement": "Record the standing grant or registered representation under which signer:security-bot acts, with scope and expiry."
    },
    {
      "code": "signature_level_unknown",
      "requirement": "State the signature level the request will use (simple, advanced or qualified)."
    },
    {
      "code": "approval_missing",
      "requirement": "Ask the owner to approve action hash cf64614dfc0d37367eddc5b11b741a95a1eff03c55a1540d10d291a1cccc9e2a before the expiry."
    }
  ],
  "allowedPreparationSteps": [],
  "prohibitedSteps": [
    "Send the signature request (never here; only the owner, through the chosen provider, after approval)",
    "Sign or apply any signature or seal",
    "Declare a signature or the document legally valid",
    "Consent, accept or waive anything on anyone's behalf",
    "Store or transmit the raw document",
    "Call the provider's API"
  ],
  "approvalRequired": true,
  "approvalStatus": "missing",
  "cost": {
    "relevant": true,
    "estimatedMinor": 250,
    "currency": "EUR",
    "budgetMinor": 1000,
    "withinBudget": true,
    "source": "caller",
    "note": "Within the budget; nothing is charged by this check."
  },
  "signatureLevel": {
    "requested": "unknown",
    "policyMinimum": "advanced",
    "meetsPolicy": null,
    "note": "Unknown level. Jithox policy asks at least \"advanced\" for a other document before an agent prepares it; whether a level is legally sufficient is not assessed here."
  },
  "signers": [
    {
      "ref": "signer:security-bot",
      "role": "agent_on_behalf",
      "external": false,
      "authorityOk": false
    },
    {
      "ref": "signer:customer-ciso",
      "role": "counterparty",
      "external": true,
      "authorityOk": true
    }
  ],
  "expiresAt": "2026-09-17T12:00:00.000Z",
  "actionHash": "cf64614dfc0d37367eddc5b11b741a95a1eff03c55a1540d10d291a1cccc9e2a",
  "evidence": {
    "required": [
      "ev-scope-letter"
    ],
    "supplied": [
      "ev-scope-letter"
    ],
    "missing": []
  },
  "replayProtection": {
    "scope": "process_memory",
    "durable": false,
    "idempotencyKey": "security-pentest-auth-2026-09-10"
  },
  "receipt": {
    "kind": "agent_agreement_preflight_receipt",
    "signature": "unsigned_hash_bound",
    "algorithm": "sha256-canonical-json",
    "digest": "848384367e4c0561e487db5b5f104732ce29c0ecf3f02f57a7263c2edd6cb0a1",
    "boundTo": {
      "actionHash": "cf64614dfc0d37367eddc5b11b741a95a1eff03c55a1540d10d291a1cccc9e2a",
      "decision": "BLOCKED",
      "policyVersion": "jithox.agreement-preflight-policy/v1",
      "evaluatedAt": "2026-09-10T12:00:00.000Z",
      "preflightId": "agp_cf64614dfc0d3736"
    },
    "note": "This receipt is NOT signed, is NOT a signature, and says nothing about legal validity. It is bound by a sha256 digest over the canonical decision; anyone can recompute it."
  },
  "signed": false,
  "sent": false,
  "legalValidity": "not_assessed",
  "executed": false,
  "evaluatedAt": "2026-09-10T12:00:00.000Z"
}