{
  "$schema": "https://json-schema.org/draft-07/schema#",
  "$id": "https://www.agentkind.org/protocol/settlement/v0.1/schemas/authorization.schema.json",
  "title": "Agentkind Settlement Protocol v0.1 — Authorization",
  "description": "LAYER 2 (AUTHORIZATION). A payer explicitly authorizes a specific payment request. Authorization is separate from the request, separate from the on-chain signature, and separate from settlement. The VPS stores NO signature, NO key, and performs NO signing.",
  "type": "object",
  "required": [
    "protocol_version",
    "authorization_id",
    "request_id",
    "authorizer",
    "authorized_amount",
    "authorized_asset",
    "scope"
  ],
  "additionalProperties": false,
  "properties": {
    "protocol_version": { "const": "0.1" },
    "authorization_id": { "type": "string", "pattern": "^akind-auth-[A-Za-z0-9._-]{4,64}$" },
    "request_id": { "type": "string", "pattern": "^akind-req-[A-Za-z0-9._-]{4,64}$" },
    "authorizer": {
      "type": "object",
      "required": ["kind", "id"],
      "additionalProperties": false,
      "properties": {
        "kind": { "enum": ["human", "agent"] },
        "id": { "type": "string", "minLength": 1, "maxLength": 128 }
      }
    },
    "authorized_at": { "type": "string", "format": "date-time" },
    "authorized_amount": { "type": "string", "pattern": "^[0-9]+$" },
    "authorized_asset": {
      "type": "object",
      "required": ["mint", "network", "symbol"],
      "additionalProperties": false,
      "properties": {
        "mint": { "const": "6ab7HysqYKjzeyDRqTRS73jt8UKsK6HfdRfmXEVcpump" },
        "network": { "const": "solana" },
        "symbol": { "const": "AKIND" }
      }
    },
    "scope": { "type": "string", "minLength": 1, "maxLength": 500, "description": "What this authorization permits, bounded to request_id." },
    "revocable": { "type": "boolean", "default": true },
    "expires_at": { "type": "string", "format": "date-time" },
    "signature_ref": {
      "type": "string",
      "description": "REFERENCE to an off-chain signature the payer produced with their own wallet. The VPS MUST NOT store the signature material or any private key."
    }
  }
}