Struct NhiClaims 

pub struct NhiClaims {

    pub sub: String,
    pub iss: String,
    pub aud: Audience,
    pub iat: u64,
    pub nbf: Option<u64>,
    pub exp: u64,
    pub jti: String,
    pub azp: Option<String>,
    pub act: Option<ActorClaim>,
    pub instance_uid: String,
    pub charter: String,
    pub version: String,
    pub scopes: Vec<String>,
    pub parent_token: Option<String>,
}

Claims carried by an AgentVisor AI NHI token.

Standard claims (sub, iss, aud, iat, nbf, exp, jti) plus the agent identity block and scopes. parent_token embeds the parent’s full JWT for delegation-chain verification.

RFC 8693 additions: azp (authorized party — the client that obtained the token) and act (actor — the agent acting on behalf of sub).

Fields

sub: String

Subject: the human principal (e.g. user:alice@corp.com). Under RFC 8693 semantics, sub stays the human and agent identity moves to act.sub.

iss: String

Issuer (corporate IdP or the harness’s own token service).

aud: Audience

Audience (the harness deployment id). RFC 7519 §4.1.3 allows either a single string or an array of strings; both are accepted here so mainstream IdPs (Okta, Auth0, Azure AD, Cognito) that emit multi-audience tokens are compatible.

iat: u64

Issued-at, epoch seconds.

nbf: Option<u64>

Not-before, epoch seconds.

exp: u64

Expiry, epoch seconds. exp - iat must be ≤ MAX_TTL_SECS.

jti: String

Unique token id (revocation hook).

azp: Option<String>

Authorized party (RFC 7519): the OAuth 2.0 client_id that obtained this token. Used in token-exchange flows to track which client requested the exchange.

act: Option<ActorClaim>

RFC 8693 actor claim. When present, sub identifies the human principal and act.sub identifies the agent acting on their behalf. Nested act.act represents further delegation hops.

instance_uid: String

Agent instance uid bound into every emitted event.

charter: String

Agent charter.

version: String

Agent version.

scopes: Vec<String>

Granted scopes, e.g. tool:db_write, payout.

parent_token: Option<String>

Parent agent’s full JWT (delegation). None for root tokens.

Implementations

impl NhiClaims

pub fn scopes_cover(&self, candidate: &NhiClaims) -> bool

True when candidate’s scopes are a subset of self’s.

Trait Implementations

impl Clone for NhiClaims

fn clone(&self) -> NhiClaims

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NhiClaims

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for NhiClaims

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl From<&NhiClaims> for RevocationIdentity

fn from(claims: &NhiClaims) -> Self

Converts to this type from the input type.

impl Serialize for NhiClaims

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.