Receiver creates a challenge
The receiver hashes the exact request bytes and sends the presenter agent, action, digest, and idempotency key. Totem returns a nonce and five-minute challenge.
Totem protocol
Bind one external agent to one action and request.
The receiving workload creates the challenge, the named presenter creates a short-lived signed presentation, and the receiver consumes it once. Totem rechecks current authority before returning evidence.
Establish the principals first.
Both organizations must be verified, connected by an active relationship, and represented by active registered agents. The presenter needs an active recipient-bound credential for the requested action. Presenter and receiver workloads should have different keys with credential.present and credential.verify scopes where practical.
Each deployment publishes /.well-known/totem-configuration and the OpenAPI 3.1 contract at /api/v1/openapi.json. Integrations should pin the expected HTTPS origin and protocol version.
Challenge, present, then consume once.
Presenter creates proof
The presenter authenticates, supplies its credential, challenge, and nonce, then receives a signed presentation with a one-minute maximum lifetime.
Receiver consumes proof
The receiver submits the presentation once. Totem locks relevant state and rechecks identity, relationship, keys, scope, limits, and revocation.
Receiver enforces policy
The receiver accepts only a complete approval with the expected challenge and fresh local digest, then applies its own business policy.
Treat every incomplete result as a failure.
Authentication failures return 401. Policy rejections return 403 with a structured reason. Conflicts and consumed state return 409, expiry returns 410, and rate limits return 429 with retry information. Network errors, timeouts, malformed JSON, server errors, and unknown reason codes never count as approval.
Challenge and presentation artifacts contain short-lived bearer material. Keep raw keys and temporary proof out of URLs, logs, metrics, shell arguments, and shared temporary directories. Prefer in-memory transfer and persist only the redacted evidence needed for audit.
Totem is the current product name.
New integrations can install the totemlayer npm package and use its totem command, TOTEM_* environment variables, and x-totem-api-key. Existing agenttrust commands, headers, configuration routes, and protocol identifiers remain compatibility aliases so deployed credentials and integrations continue to verify.
TotemLayer
Test the complete verification boundary.
Exercise approval, replay, expiry, wrong digest, wrong recipient, insufficient scope, and revocation before production use.