Skip to main content
Version: v0.12.11

Profiles

Profiles are documentation overlays that describe how to use PEAC for specific use cases, regulatory contexts, or integration patterns. A profile constrains and documents existing PEAC structures; it does not add new schema fields.

Profiles are documentary, not runtime-enforced. Schema validation (@peac/schema) enforces field structure; verifyLocal() enforces protocol behavior including type-to-extension enforcement. Profiles document recommended usage patterns on top of those layers.


Pillar Profiles

9 pillar profiles document how to use a specific PEAC extension group for a regulatory, operational, or evidence workflow. Each profile includes schema-vs-profile field tables, non-goals, and strict-mode demonstrations.

ProfileExtension GroupDescription
Accessorg.peacprotocol/accessAccess control decisions (resource, action, decision)
Identityorg.peacprotocol/identityIdentity attestation and proof references
Consentorg.peacprotocol/consentConsent records (basis, scope, expiry)
Privacyorg.peacprotocol/privacyPrivacy and data handling evidence
Safetyorg.peacprotocol/safetyAI safety and guardrail evidence
Complianceorg.peacprotocol/complianceRegulatory compliance evidence
Provenanceorg.peacprotocol/provenanceData and content provenance
Attributionorg.peacprotocol/attributionContent attribution and licensing
Purposeorg.peacprotocol/purposePurpose limitation and use constraints

Commerce has a typed extension group (org.peacprotocol/commerce) but no pillar profile because it is an adapter/integration concern covered by payment rail adapters.


Extension Group Profiles

Extension group profiles document observation records for agent execution, provisioning, governance, and inter-agent coordination patterns. These profiles were introduced in v0.14.x and use the *-observed type URI suffix to indicate observer scope: PEAC records what systems report, not what PEAC itself decided.

ProfileExtension GroupVersionDescription
Provisioning Lifecycleorg.peacprotocol/provisioning-lifecyclev0.14.2Credential issuance, secret rotation, service authorization records
Lifecycle Observationorg.peacprotocol/lifecycle-observationv0.14.1Approval, evaluation, experiment, and workflow transition records
CLI Executionorg.peacprotocol/cli-executionv0.14.1Signed execution records for CLI commands and CI pipelines
A2A Handofforg.peacprotocol/a2a-handoffv0.14.1Agent-to-Agent Protocol handoff observation records (AGT/AAIF compatible)
Runtime Governanceorg.peacprotocol/runtime-governancev0.12.10Policy evaluation, safety check, compliance gate, and mode transition records (AGT/AAIF compatible)

All extension group profiles are observer-scope only. They record what upstream systems attested. PEAC does not evaluate policies, authorize actions, or enforce governance rules.


Adapter Profiles

Adapter profiles document how to normalize external protocol artifacts into PEAC receipts for a specific integration.

ProfilePackageDescription
Stripe x402 Machine Payments@peac/adapter-x402Payment evidence for Stripe-backed x402 flows
MPP / paymentauth@peac/mappings-paymentauthHTTP Auth payment challenge and receipt evidence (draft-ryan-httpauth-payment)

Profile Structure

Pillar profiles (10 sections): Overview, extension group reference, schema-vs-profile field table, required fields, optional fields, type-to-extension enforcement behavior, non-goals, strict-mode demonstration, interop-mode behavior, examples.

Extension group profiles (12 sections): Overview, observer scope boundary, type URI registry (with all *-observed URIs), required fields per event kind, opaque reference grammar, forbidden inline values, error code catalog, conformance section mapping, usage examples, composition patterns, non-goals.

Adapter profiles (8 sections): Overview, package reference, input/output mapping, normalization rules, verification behavior, conformance vectors, limitations, examples.


Observer Scope Doctrine

All extension group profiles use observer scope. This means:

  • PEAC records what the caller reports as having happened
  • PEAC does not evaluate, authorize, approve, or enforce the underlying action
  • Upstream systems (policy engines, authorization servers, orchestrators) own their decisions
  • PEAC provides portable, offline-verifiable evidence of what was reported

If your upstream system evaluated a safety check and approved an action, PEAC records that evaluation result as an observation. The safety check itself was not performed by PEAC.