feat(signing): BrandAuthorizationResolver — per-brand agent authorization (Tier 3, gated on ADCP #3690)

[bokelley]

Summary

Tier 3 of the v3-identity / round-2 SDK roadmap. Net-new on both Python and JS: per-request "is this agent authorized for this brand?" check via brand.json/agents[] array with eTLD+1 binding.

Blocked on adcp#3690 closing — design provisional until spec lands.

Design

Full design lives in the RFC — see docs/proposals/v3-identity-bundle-design.md.

Naming finalized per #346: BrandAuthorizationResolver (not AdagentsResolver).

Surface

• BrandAuthorizationResolver Protocol with is_authorized(agent_url, brand_domain, agent_type?) method
• eTLD+1 helper using tldextract (host eTLD+1 must match brand_url eTLD+1)
• authorized_operators[] delegation logic — host appears in this array for SaaS-as-operator multi-tenancy
• identity.key_origins.{purpose} consistency check on the verifier
• Diff #3690's seven new request_signature_* error codes against existing 17
• Shares _BrandJsonFetcher with Tier 1's BrandJsonJwksResolver (factor out during implementation)

Cross-references

• RFC: docs/proposals/v3-identity-bundle-design.md
• ADCP spec issue: adcp#3690 (verifier chain)
• Naming decision: #346
• Tier 1 (merged): PR #345
• JS parity tracker: adcp-client#1249

🤖 Generated with Claude Code

[bokelley]

Triage

Classification: Feature request
Bucket(s): signing, cross-repo (neither label exists in this repo — flagged in run summary)
Status: deferred

What the experts said:

• (not consulted — pre-classification defer: explicitly child-of-open-parent)

My take: The issue body states the design is provisional until adcp#3690 (verifier chain spec) closes, and seven of the planned request_signature_* error codes depend on that spec landing. Implementing BrandAuthorizationResolver before the spec finalizes risks drift against the canonical shape and a costly rework.

Blocked-on: adcontextprotocol/adcp#3690 — resurfaces on merge.

---

Triaged by Claude Code. Session: https://claude.ai/code/cse_01Q3WHkqN3xBYMGYtB52CAhb

---

Generated by Claude Code