A buyer invites a supplier to qualify for WAN services — a €12M value tier. The supplier presents five credentials. Under a published eligibility Policy and a bounded Mandate, the agent verifies each one: identity, insurance, ISO 27001, and a clear sanctions screening all pass — but financial standing covers only €5M of the €12M tier.
A missing-but-non-blocking shortfall isn't a rejection. The agent qualifies the supplier conditionally — active up to €5M, with a machine-readable value cap and a pending-check condition for an upgraded financial credential. Attaching conditions is a judgement outside the agent's autonomous scope, so a named human approval is required and recorded.
What the agent read
Five credentials, one shortfall
The supplier presents five verifiable credentials against the buyer's published eligibility policy. Four pass cleanly; financial standing is valid but covers only part of the value tier — the non-blocking shortfall that drives the conditional outcome.
Eligibility policyTo qualify for WAN services (CPV 72720000), a supplier must present: valid legal identity; current insurance; ISO/IEC 27001 certification; a clear sanctions screening; and financial standing sufficient for the category value tier (EUR 12,000,000). A financial-standing shortfall is non-blocking: qualify conditionally, capped at the supported value, pending an upgraded financial credential.
- Legal identityvalid
- Insurancevalid
- ISO/IEC 27001valid
- Sanctions screeningclear
- Financial standingsupports up to 5000000 of 12000000
The committed run
Read → verify → decide → gate → seal
Produced by the deterministic onboarding agent at build time and verified against the SIGNET conformance tests. Nothing here executes in your browser — it is the proof, rendered.
- Onboarding case onboarding-4471 opened for acme (entry: invited) against policy policy-onboarding-telco.
- Category: WAN services, value tier 12,000,000 EUR. Required: identity, insurance, certification, sanctionsScreening, financialStanding.
- Verifying 5 required credentials:
- ✓ identity: valid
- ✓ insurance: valid
- ✓ certification: valid
- ✓ sanctionsScreening: clear
- △ financialStanding: supports up to 5000000 of 12000000
- Outcome: CONDITIONAL. Conditional qualification: all blocking checks pass and sanctions screening is clear, but financial standing covers only part of the category value tier. Qualified with a value cap pending an upgraded financial credential.
- Mandate: attaching conditions is outside autonomous scope → human approval approval-cond-118 required and recorded.
- SupplierQualification qual-acme created: status CONDITIONAL with 2 condition(s) (cap 5,000,000 EUR).
- Event stream: 7 events, hash-chained.
- ValidThe OnboardingCase, SupplierQualification, and qualification Decision all carry their required SIGNET fields. CI runs full JSON-Schema validation on each commit.
- Conditional — the hero outcomeNot a blunt pass/fail: financial standing covers only part of the value tier, so the supplier is qualified with a machine-readable value cap (2 conditions) pending an upgraded credential.
- BoundedMandate-bound — attaching conditions is outside the agent's autonomous scope, so a named human approval is attached.
- Tamper-evidentThe 7-event hash chain holds; mutating any event's payload breaks it.
- AttributableThe Decision and every Event carry cryptographic provenance (who acted, when, from what).
{
"@context": "https://concert.foundation/signet/v0.1/context.jsonld",
"type": "SupplierQualification",
"id": {
"scheme": "did",
"id": "did:web:buyer.example#qual-acme"
},
"supplier": {
"scheme": "did",
"id": "did:web:acme-networks.example#acme"
},
"qualifiedBy": {
"scheme": "did",
"id": "did:web:buyer.example#buyer"
},
"status": "conditional",
"conditions": [
{
"conditionType": "valueCap",
"description": "Qualified to a maximum single-contract value of EUR 5,000,000 pending an upgraded financial-standing credential (category tier EUR 12,000,000).",
"valueCap": {
"amount": 5000000,
"currency": "EUR"
}
},
{
"conditionType": "pendingCheck",
"description": "Upgraded financial-standing credential required for unconditional qualification.",
"dueDate": "2026-09-30T00:00:00Z"
}
],
"classifications": [
{
"scheme": "cpv",
"id": "72720000",
"description": "Wide area network services"
}
],
"credentials": [
{
"id": "urn:cred:identity:acme",
"type": [
"VerifiableCredential",
"identity"
],
"issuer": {
"scheme": "did",
"id": "did:web:companies-house.example#ch"
},
"issuanceDate": "2024-01-10T00:00:00Z",
"credentialSubject": {
"legalName": "Acme Networks Ltd",
"registration": "12345678"
},
"proof": {
"type": "manualAttestation"
}
},
{
"id": "urn:cred:insurance:acme",
"type": [
"VerifiableCredential",
"insurance"
],
"issuer": {
"scheme": "did",
"id": "did:web:insurer.example#ins"
},
"issuanceDate": "2026-01-01T00:00:00Z",
"expirationDate": "2026-12-31T00:00:00Z",
"credentialSubject": {
"cover": "professional-indemnity",
"limit": {
"amount": 10000000,
"currency": "EUR"
}
},
"proof": {
"type": "manualAttestation"
}
},
{
"id": "urn:cred:iso27001:acme",
"type": [
"VerifiableCredential",
"certification"
],
"issuer": {
"scheme": "did",
"id": "did:web:ukas.example#ukas"
},
"issuanceDate": "2025-09-01T00:00:00Z",
"expirationDate": "2028-09-01T00:00:00Z",
"credentialSubject": {
"standard": "ISO/IEC 27001:2022"
},
"proof": {
"type": "manualAttestation"
}
},
{
"id": "urn:cred:sanctions:acme",
"type": [
"VerifiableCredential",
"sanctionsScreening"
],
"issuer": {
"scheme": "did",
"id": "did:web:screening-provider.example#provider"
},
"issuanceDate": "2026-06-20T00:00:00Z",
"credentialSubject": {
"result": "clear",
"listsChecked": [
"UN",
"OFAC",
"EU",
"UK-HMT"
]
},
"proof": {
"type": "providerAttestation"
}
},
{
"id": "urn:cred:financial:acme",
"type": [
"VerifiableCredential",
"financialStanding"
],
"issuer": {
"scheme": "did",
"id": "did:web:credit-agency.example#agency"
},
"issuanceDate": "2026-05-01T00:00:00Z",
"credentialSubject": {
"maxContractValue": {
"amount": 5000000,
"currency": "EUR"
},
"rating": "BBB"
},
"proof": {
"type": "manualAttestation"
}
}
],
"validity": {
"startDate": "2026-06-22T00:00:00Z",
"endDate": "2027-06-22T00:00:00Z"
},
"lastDecision": {
"scheme": "did",
"id": "did:web:buyer.example#decision-onb-4471"
},
"originatingCase": {
"scheme": "did",
"id": "did:web:buyer.example#onboarding-4471"
}
}{
"@context": "https://concert.foundation/signet/v0.1/context.jsonld",
"type": "Decision",
"id": {
"scheme": "did",
"id": "did:web:buyer.example#decision-onb-4471"
},
"decisionType": "qualification",
"madeBy": {
"scheme": "did",
"id": "did:web:buyer.example#agent-qual-2"
},
"underMandate": {
"scheme": "did",
"id": "did:web:buyer.example#mandate-qual-2"
},
"inputs": [
{
"scheme": "uri",
"id": "urn:cred:identity:acme"
},
{
"scheme": "uri",
"id": "urn:cred:insurance:acme"
},
{
"scheme": "uri",
"id": "urn:cred:iso27001:acme"
},
{
"scheme": "uri",
"id": "urn:cred:sanctions:acme"
},
{
"scheme": "uri",
"id": "urn:cred:financial:acme"
}
],
"policiesApplied": [
{
"scheme": "did",
"id": "did:web:buyer.example#policy-onboarding-telco"
}
],
"rationale": "Conditional qualification: all blocking checks pass and sanctions screening is clear, but financial standing covers only part of the category value tier. Qualified with a value cap pending an upgraded financial credential.",
"outcome": {
"qualification": "conditional",
"conditions": [
{
"conditionType": "valueCap",
"description": "Qualified to a maximum single-contract value of EUR 5,000,000 pending an upgraded financial-standing credential (category tier EUR 12,000,000).",
"valueCap": {
"amount": 5000000,
"currency": "EUR"
}
},
{
"conditionType": "pendingCheck",
"description": "Upgraded financial-standing credential required for unconditional qualification.",
"dueDate": "2026-09-30T00:00:00Z"
}
],
"supplier": "did:web:acme-networks.example#acme"
},
"provenance": {
"generatedBy": {
"scheme": "did",
"id": "did:web:buyer.example#agent-qual-2"
},
"generatedAt": "2026-06-22T00:00:00Z",
"derivedFrom": [
{
"scheme": "uri",
"id": "urn:cred:identity:acme"
},
{
"scheme": "uri",
"id": "urn:cred:insurance:acme"
},
{
"scheme": "uri",
"id": "urn:cred:iso27001:acme"
},
{
"scheme": "uri",
"id": "urn:cred:sanctions:acme"
},
{
"scheme": "uri",
"id": "urn:cred:financial:acme"
}
],
"usedPolicies": [
{
"scheme": "did",
"id": "did:web:buyer.example#policy-onboarding-telco"
}
]
},
"humanApproval": {
"scheme": "did",
"id": "did:web:buyer.example#approval-cond-118"
}
}{
"@context": "https://concert.foundation/signet/v0.1/context.jsonld",
"type": "OnboardingCase",
"id": {
"scheme": "did",
"id": "did:web:buyer.example#onboarding-4471"
},
"subjectParty": {
"scheme": "did",
"id": "did:web:acme-networks.example#acme"
},
"initiatingParty": {
"scheme": "did",
"id": "did:web:buyer.example#buyer"
},
"caseType": "onboarding",
"entryMode": "invited",
"status": "qualified",
"eligibilityPolicy": {
"scheme": "did",
"id": "did:web:buyer.example#policy-onboarding-telco"
},
"requiredCredentialTypes": [
"identity",
"insurance",
"certification",
"sanctionsScreening",
"financialStanding"
],
"collectedCredentials": [
{
"id": "urn:cred:identity:acme",
"type": [
"VerifiableCredential",
"identity"
],
"issuer": {
"scheme": "did",
"id": "did:web:companies-house.example#ch"
},
"issuanceDate": "2024-01-10T00:00:00Z",
"credentialSubject": {
"legalName": "Acme Networks Ltd",
"registration": "12345678"
},
"proof": {
"type": "manualAttestation"
}
},
{
"id": "urn:cred:insurance:acme",
"type": [
"VerifiableCredential",
"insurance"
],
"issuer": {
"scheme": "did",
"id": "did:web:insurer.example#ins"
},
"issuanceDate": "2026-01-01T00:00:00Z",
"expirationDate": "2026-12-31T00:00:00Z",
"credentialSubject": {
"cover": "professional-indemnity",
"limit": {
"amount": 10000000,
"currency": "EUR"
}
},
"proof": {
"type": "manualAttestation"
}
},
{
"id": "urn:cred:iso27001:acme",
"type": [
"VerifiableCredential",
"certification"
],
"issuer": {
"scheme": "did",
"id": "did:web:ukas.example#ukas"
},
"issuanceDate": "2025-09-01T00:00:00Z",
"expirationDate": "2028-09-01T00:00:00Z",
"credentialSubject": {
"standard": "ISO/IEC 27001:2022"
},
"proof": {
"type": "manualAttestation"
}
},
{
"id": "urn:cred:sanctions:acme",
"type": [
"VerifiableCredential",
"sanctionsScreening"
],
"issuer": {
"scheme": "did",
"id": "did:web:screening-provider.example#provider"
},
"issuanceDate": "2026-06-20T00:00:00Z",
"credentialSubject": {
"result": "clear",
"listsChecked": [
"UN",
"OFAC",
"EU",
"UK-HMT"
]
},
"proof": {
"type": "providerAttestation"
}
},
{
"id": "urn:cred:financial:acme",
"type": [
"VerifiableCredential",
"financialStanding"
],
"issuer": {
"scheme": "did",
"id": "did:web:credit-agency.example#agency"
},
"issuanceDate": "2026-05-01T00:00:00Z",
"credentialSubject": {
"maxContractValue": {
"amount": 5000000,
"currency": "EUR"
},
"rating": "BBB"
},
"proof": {
"type": "manualAttestation"
}
}
],
"decision": {
"scheme": "did",
"id": "did:web:buyer.example#decision-onb-4471"
},
"producesQualification": {
"scheme": "did",
"id": "did:web:buyer.example#qual-acme"
},
"period": {
"startDate": "2026-06-15T00:00:00Z",
"endDate": "2026-06-22T00:00:00Z"
}
}Produced by onboarding/run-onboarding.js; verified against the SIGNET conformance tests and the same harness that certifies implementations. It runs in CI on every commit to concerthq/signet-standard at v0.12.0: the OnboardingCase, SupplierQualification, and Decision must validate and the event chain must hold.
Run it yourself
The same agent, in your browser
Press Run to execute the deterministic qualification agent client-side — identical logic to the repository, so the trace, the conditional outcome, and the hash-chained events match CI exactly. Raise the financial cap to the €12M tier and watch the conditional resolve to a clean, active qualification; expire a blocking credential and the agent rejects; tamper with an event and the verification turns red.
category tier €12,000,000 · €5,000,000 falls short → conditional (value-capped)
Press Run the agent to qualify the supplier in your browser — the same deterministic logic that runs in CI, so the trace, the conditional outcome, and the hash-chained events are byte-identical to the repository’s. Then raise the financial cap to €12,000,000 and watch the conditional resolve.
The agent declares its capabilities through an A2A Agent Card: verify.credential, qualify.supplier. Both are bounded by the Mandate.
Why the conditional outcome matters
The judgement ordinary onboarding tooling can't make
A yes/no pipeline rejects this supplier or waves them through. Neither is right. The valuable, real-world outcome is “qualified, but capped pending a check” — derived from policy plus credentials, under governance, with the limits recorded as machine-readable conditions a downstream sourcing agent must honour.
This is the deterministic reasoner — its logic is fixed, so the conditional outcome is identical on every run, which is what makes it a proof rather than a one-off. A live frontier model can drive the identical flow with no change to the governance (mandate gate, object production, provenance, tamper-evident chain, conformance pass). The verification keys off credential types and proofs, not a fixed schema of forms: swap any proof to an issuer-signed credential and the decision is unchanged.