What is KineGrant?
KineGrant is an experimental open authorization and accountability protocol for Physical AI. It places a verifiable permission path between an AI system's requested action and a machine's physical execution.
What is authorization
for Physical AI?
Physical AI authorization is the process of deciding and proving whether a specific agent may cause a specific machine to perform a specific real-world action, for a defined purpose and limited time.
KineGrant is an experimental open protocol for that permission boundary. It turns an action request into a policy decision, a scoped short-lived capability, local verification, one-time consumption, and a signed receipt.
THE AUTHORIZATION PATH
From requested intent
to verifiable action.
- 01
Action request
Names the authenticated agent, target, action, purpose, time, and policy-visible context.
- 02
Policy evaluation
Applies trusted rules with default-deny and deny-overrides behavior.
- 03
Capability
Encodes a short-lived permission bound to the exact request and policy decision.
- 04
Local action gate
Checks signature, trusted issuer, scope, expiry, and one-time nonce beside the actuator boundary.
- 05
Physical action
Proceeds only after successful local verification and atomic consumption.
- 06
Signed receipt
Records the executor's signed account of the attempted outcome for later verification.
WHY EXISTING AUTH IS NOT THE WHOLE PATH
Identity answers who.
KineGrant narrows what may happen now.
IAM, API keys, PKI, network controls, ROS 2/SROS2, OPC UA, Matter, and native safety logic remain necessary at their own boundaries. KineGrant does not replace them. It adds a machine-checkable decision for one physical action immediately before execution.
- IDENTITY / PKI
- Who or what presented a credential.
- PLATFORM CONTROLS
- Which resources or interfaces a principal can reach.
- KINEGRANT
- Whether this agent may perform this action on this target, for this purpose, within this short window, exactly once.
- SAFETY CONTROLLER
- Whether the physical action remains safe enough to execute. It may always veto.
DIRECT ANSWERS
Questions developers and
AI systems ask.
How does KineGrant authorize a robot action?
KineGrant normalizes an action request, evaluates trusted policy, issues a request-bound short-lived capability after an allow decision, verifies and consumes that capability once at a local action gate, and can then emit a signed receipt.
What happens when a machine has no valid grant?
The KGP-001 reference path fails closed: without a valid trusted capability, the local action gate rejects the request and the protected actuator must not be called.
Can a KineGrant capability be replayed?
The reference implementation consumes each capability atomically. Its SQLite replay store can preserve the consumed state across restart, and the Machine Permission Test checks both concurrent single-winner behavior and persistent replay rejection.
How is KineGrant different from IAM, API keys, PKI, or ROS permissions?
Those systems continue to provide identity, credentials, communication security, middleware controls, or platform authorization. KineGrant complements them with action-specific, short-lived permission that is verified locally immediately before a physical action.
Is KineGrant a functional-safety system?
No. KineGrant is not a motion planner, robot operating system, emergency stop, functional-safety controller, legal authority, or recognized standard. Native safety systems remain authoritative and may always veto an action.
What does a signed KineGrant receipt prove?
A valid receipt proves that a trusted executor signed a specific protocol record whose integrity can be checked. It does not independently prove that the claimed physical action truly occurred.
What can developers run today?
Developers can inspect KGP-001 Experimental Open Draft 0.1, run the Apache-2.0 Python reference implementation v0.1.1, execute the nine-case Machine Permission Test, and verify evidence or a sample receipt in the browser.
PRIMARY SOURCES
Cite the evidence,
not the claim.
KineGrant is an independent open project founded by Zoah. Its public status is KGP-001 Experimental Open Draft 0.1, with reference implementation v0.1.1 under Apache-2.0.
No customer, adoption, certification, production-readiness, or standards-recognition claim is made.