Governed onboarding

Watch an AI agent qualify a supplier — conditionally

The onboarding twin of the award demo, and proof the governance harness generalises. The same agent that awards a contract here qualifies a supplier — and instead of a blunt pass/fail, lands on the outcome enterprise onboarding actually needs: a conditional qualification.

A buyer invites a supplier to qualify for WAN services — a €12M value tier. The supplier presents five credentials. Under a published eligibility Policy and a bounded Mandate, the agent verifies each one: identity, insurance, ISO 27001, and a clear sanctions screening all pass — but financial standing covers only €5M of the €12M tier.

A missing-but-non-blocking shortfall isn't a rejection. The agent qualifies the supplier conditionally — active up to €5M, with a machine-readable value cap and a pending-check condition for an upgraded financial credential. Attaching conditions is a judgement outside the agent's autonomous scope, so a named human approval is required and recorded.

What the agent read

Five credentials, one shortfall

The supplier presents five verifiable credentials against the buyer's published eligibility policy. Four pass cleanly; financial standing is valid but covers only part of the value tier — the non-blocking shortfall that drives the conditional outcome.

Eligibility policyTo qualify for WAN services (CPV 72720000), a supplier must present: valid legal identity; current insurance; ISO/IEC 27001 certification; a clear sanctions screening; and financial standing sufficient for the category value tier (EUR 12,000,000). A financial-standing shortfall is non-blocking: qualify conditionally, capped at the supported value, pending an upgraded financial credential.
  • Legal identityvalid
  • Insurancevalid
  • ISO/IEC 27001valid
  • Sanctions screeningclear
  • Financial standingsupports up to 5000000 of 12000000

The committed run

Read → verify → decide → gate → seal

Produced by the deterministic onboarding agent at build time and verified against the SIGNET conformance tests. Nothing here executes in your browser — it is the proof, rendered.

  1. Onboarding case onboarding-4471 opened for acme (entry: invited) against policy policy-onboarding-telco.
  2. Category: WAN services, value tier 12,000,000 EUR. Required: identity, insurance, certification, sanctionsScreening, financialStanding.
  3. Verifying 5 required credentials:
  4. ✓ identity: valid
  5. ✓ insurance: valid
  6. ✓ certification: valid
  7. ✓ sanctionsScreening: clear
  8. △ financialStanding: supports up to 5000000 of 12000000
  9. Outcome: CONDITIONAL. Conditional qualification: all blocking checks pass and sanctions screening is clear, but financial standing covers only part of the category value tier. Qualified with a value cap pending an upgraded financial credential.
  10. Mandate: attaching conditions is outside autonomous scope → human approval approval-cond-118 required and recorded.
  11. SupplierQualification qual-acme created: status CONDITIONAL with 2 condition(s) (cap 5,000,000 EUR).
  12. Event stream: 7 events, hash-chained.
Conformance verification of the agent's outputconformance-clean
  • ValidThe OnboardingCase, SupplierQualification, and qualification Decision all carry their required SIGNET fields. CI runs full JSON-Schema validation on each commit.
  • Conditional — the hero outcomeNot a blunt pass/fail: financial standing covers only part of the value tier, so the supplier is qualified with a machine-readable value cap (2 conditions) pending an upgraded credential.
  • BoundedMandate-bound — attaching conditions is outside the agent's autonomous scope, so a named human approval is attached.
  • Tamper-evidentThe 7-event hash chain holds; mutating any event's payload breaks it.
  • AttributableThe Decision and every Event carry cryptographic provenance (who acted, when, from what).
supplier-qualification.json
{
  "@context": "https://concert.foundation/signet/v0.1/context.jsonld",
  "type": "SupplierQualification",
  "id": {
    "scheme": "did",
    "id": "did:web:buyer.example#qual-acme"
  },
  "supplier": {
    "scheme": "did",
    "id": "did:web:acme-networks.example#acme"
  },
  "qualifiedBy": {
    "scheme": "did",
    "id": "did:web:buyer.example#buyer"
  },
  "status": "conditional",
  "conditions": [
    {
      "conditionType": "valueCap",
      "description": "Qualified to a maximum single-contract value of EUR 5,000,000 pending an upgraded financial-standing credential (category tier EUR 12,000,000).",
      "valueCap": {
        "amount": 5000000,
        "currency": "EUR"
      }
    },
    {
      "conditionType": "pendingCheck",
      "description": "Upgraded financial-standing credential required for unconditional qualification.",
      "dueDate": "2026-09-30T00:00:00Z"
    }
  ],
  "classifications": [
    {
      "scheme": "cpv",
      "id": "72720000",
      "description": "Wide area network services"
    }
  ],
  "credentials": [
    {
      "id": "urn:cred:identity:acme",
      "type": [
        "VerifiableCredential",
        "identity"
      ],
      "issuer": {
        "scheme": "did",
        "id": "did:web:companies-house.example#ch"
      },
      "issuanceDate": "2024-01-10T00:00:00Z",
      "credentialSubject": {
        "legalName": "Acme Networks Ltd",
        "registration": "12345678"
      },
      "proof": {
        "type": "manualAttestation"
      }
    },
    {
      "id": "urn:cred:insurance:acme",
      "type": [
        "VerifiableCredential",
        "insurance"
      ],
      "issuer": {
        "scheme": "did",
        "id": "did:web:insurer.example#ins"
      },
      "issuanceDate": "2026-01-01T00:00:00Z",
      "expirationDate": "2026-12-31T00:00:00Z",
      "credentialSubject": {
        "cover": "professional-indemnity",
        "limit": {
          "amount": 10000000,
          "currency": "EUR"
        }
      },
      "proof": {
        "type": "manualAttestation"
      }
    },
    {
      "id": "urn:cred:iso27001:acme",
      "type": [
        "VerifiableCredential",
        "certification"
      ],
      "issuer": {
        "scheme": "did",
        "id": "did:web:ukas.example#ukas"
      },
      "issuanceDate": "2025-09-01T00:00:00Z",
      "expirationDate": "2028-09-01T00:00:00Z",
      "credentialSubject": {
        "standard": "ISO/IEC 27001:2022"
      },
      "proof": {
        "type": "manualAttestation"
      }
    },
    {
      "id": "urn:cred:sanctions:acme",
      "type": [
        "VerifiableCredential",
        "sanctionsScreening"
      ],
      "issuer": {
        "scheme": "did",
        "id": "did:web:screening-provider.example#provider"
      },
      "issuanceDate": "2026-06-20T00:00:00Z",
      "credentialSubject": {
        "result": "clear",
        "listsChecked": [
          "UN",
          "OFAC",
          "EU",
          "UK-HMT"
        ]
      },
      "proof": {
        "type": "providerAttestation"
      }
    },
    {
      "id": "urn:cred:financial:acme",
      "type": [
        "VerifiableCredential",
        "financialStanding"
      ],
      "issuer": {
        "scheme": "did",
        "id": "did:web:credit-agency.example#agency"
      },
      "issuanceDate": "2026-05-01T00:00:00Z",
      "credentialSubject": {
        "maxContractValue": {
          "amount": 5000000,
          "currency": "EUR"
        },
        "rating": "BBB"
      },
      "proof": {
        "type": "manualAttestation"
      }
    }
  ],
  "validity": {
    "startDate": "2026-06-22T00:00:00Z",
    "endDate": "2027-06-22T00:00:00Z"
  },
  "lastDecision": {
    "scheme": "did",
    "id": "did:web:buyer.example#decision-onb-4471"
  },
  "originatingCase": {
    "scheme": "did",
    "id": "did:web:buyer.example#onboarding-4471"
  }
}
decision.json
{
  "@context": "https://concert.foundation/signet/v0.1/context.jsonld",
  "type": "Decision",
  "id": {
    "scheme": "did",
    "id": "did:web:buyer.example#decision-onb-4471"
  },
  "decisionType": "qualification",
  "madeBy": {
    "scheme": "did",
    "id": "did:web:buyer.example#agent-qual-2"
  },
  "underMandate": {
    "scheme": "did",
    "id": "did:web:buyer.example#mandate-qual-2"
  },
  "inputs": [
    {
      "scheme": "uri",
      "id": "urn:cred:identity:acme"
    },
    {
      "scheme": "uri",
      "id": "urn:cred:insurance:acme"
    },
    {
      "scheme": "uri",
      "id": "urn:cred:iso27001:acme"
    },
    {
      "scheme": "uri",
      "id": "urn:cred:sanctions:acme"
    },
    {
      "scheme": "uri",
      "id": "urn:cred:financial:acme"
    }
  ],
  "policiesApplied": [
    {
      "scheme": "did",
      "id": "did:web:buyer.example#policy-onboarding-telco"
    }
  ],
  "rationale": "Conditional qualification: all blocking checks pass and sanctions screening is clear, but financial standing covers only part of the category value tier. Qualified with a value cap pending an upgraded financial credential.",
  "outcome": {
    "qualification": "conditional",
    "conditions": [
      {
        "conditionType": "valueCap",
        "description": "Qualified to a maximum single-contract value of EUR 5,000,000 pending an upgraded financial-standing credential (category tier EUR 12,000,000).",
        "valueCap": {
          "amount": 5000000,
          "currency": "EUR"
        }
      },
      {
        "conditionType": "pendingCheck",
        "description": "Upgraded financial-standing credential required for unconditional qualification.",
        "dueDate": "2026-09-30T00:00:00Z"
      }
    ],
    "supplier": "did:web:acme-networks.example#acme"
  },
  "provenance": {
    "generatedBy": {
      "scheme": "did",
      "id": "did:web:buyer.example#agent-qual-2"
    },
    "generatedAt": "2026-06-22T00:00:00Z",
    "derivedFrom": [
      {
        "scheme": "uri",
        "id": "urn:cred:identity:acme"
      },
      {
        "scheme": "uri",
        "id": "urn:cred:insurance:acme"
      },
      {
        "scheme": "uri",
        "id": "urn:cred:iso27001:acme"
      },
      {
        "scheme": "uri",
        "id": "urn:cred:sanctions:acme"
      },
      {
        "scheme": "uri",
        "id": "urn:cred:financial:acme"
      }
    ],
    "usedPolicies": [
      {
        "scheme": "did",
        "id": "did:web:buyer.example#policy-onboarding-telco"
      }
    ]
  },
  "humanApproval": {
    "scheme": "did",
    "id": "did:web:buyer.example#approval-cond-118"
  }
}
onboarding-case.json
{
  "@context": "https://concert.foundation/signet/v0.1/context.jsonld",
  "type": "OnboardingCase",
  "id": {
    "scheme": "did",
    "id": "did:web:buyer.example#onboarding-4471"
  },
  "subjectParty": {
    "scheme": "did",
    "id": "did:web:acme-networks.example#acme"
  },
  "initiatingParty": {
    "scheme": "did",
    "id": "did:web:buyer.example#buyer"
  },
  "caseType": "onboarding",
  "entryMode": "invited",
  "status": "qualified",
  "eligibilityPolicy": {
    "scheme": "did",
    "id": "did:web:buyer.example#policy-onboarding-telco"
  },
  "requiredCredentialTypes": [
    "identity",
    "insurance",
    "certification",
    "sanctionsScreening",
    "financialStanding"
  ],
  "collectedCredentials": [
    {
      "id": "urn:cred:identity:acme",
      "type": [
        "VerifiableCredential",
        "identity"
      ],
      "issuer": {
        "scheme": "did",
        "id": "did:web:companies-house.example#ch"
      },
      "issuanceDate": "2024-01-10T00:00:00Z",
      "credentialSubject": {
        "legalName": "Acme Networks Ltd",
        "registration": "12345678"
      },
      "proof": {
        "type": "manualAttestation"
      }
    },
    {
      "id": "urn:cred:insurance:acme",
      "type": [
        "VerifiableCredential",
        "insurance"
      ],
      "issuer": {
        "scheme": "did",
        "id": "did:web:insurer.example#ins"
      },
      "issuanceDate": "2026-01-01T00:00:00Z",
      "expirationDate": "2026-12-31T00:00:00Z",
      "credentialSubject": {
        "cover": "professional-indemnity",
        "limit": {
          "amount": 10000000,
          "currency": "EUR"
        }
      },
      "proof": {
        "type": "manualAttestation"
      }
    },
    {
      "id": "urn:cred:iso27001:acme",
      "type": [
        "VerifiableCredential",
        "certification"
      ],
      "issuer": {
        "scheme": "did",
        "id": "did:web:ukas.example#ukas"
      },
      "issuanceDate": "2025-09-01T00:00:00Z",
      "expirationDate": "2028-09-01T00:00:00Z",
      "credentialSubject": {
        "standard": "ISO/IEC 27001:2022"
      },
      "proof": {
        "type": "manualAttestation"
      }
    },
    {
      "id": "urn:cred:sanctions:acme",
      "type": [
        "VerifiableCredential",
        "sanctionsScreening"
      ],
      "issuer": {
        "scheme": "did",
        "id": "did:web:screening-provider.example#provider"
      },
      "issuanceDate": "2026-06-20T00:00:00Z",
      "credentialSubject": {
        "result": "clear",
        "listsChecked": [
          "UN",
          "OFAC",
          "EU",
          "UK-HMT"
        ]
      },
      "proof": {
        "type": "providerAttestation"
      }
    },
    {
      "id": "urn:cred:financial:acme",
      "type": [
        "VerifiableCredential",
        "financialStanding"
      ],
      "issuer": {
        "scheme": "did",
        "id": "did:web:credit-agency.example#agency"
      },
      "issuanceDate": "2026-05-01T00:00:00Z",
      "credentialSubject": {
        "maxContractValue": {
          "amount": 5000000,
          "currency": "EUR"
        },
        "rating": "BBB"
      },
      "proof": {
        "type": "manualAttestation"
      }
    }
  ],
  "decision": {
    "scheme": "did",
    "id": "did:web:buyer.example#decision-onb-4471"
  },
  "producesQualification": {
    "scheme": "did",
    "id": "did:web:buyer.example#qual-acme"
  },
  "period": {
    "startDate": "2026-06-15T00:00:00Z",
    "endDate": "2026-06-22T00:00:00Z"
  }
}

Produced by onboarding/run-onboarding.js; verified against the SIGNET conformance tests and the same harness that certifies implementations. It runs in CI on every commit to concerthq/signet-standard at v0.12.0: the OnboardingCase, SupplierQualification, and Decision must validate and the event chain must hold.

Run it yourself

The same agent, in your browser

Press Run to execute the deterministic qualification agent client-side — identical logic to the repository, so the trace, the conditional outcome, and the hash-chained events match CI exactly. Raise the financial cap to the €12M tier and watch the conditional resolve to a clean, active qualification; expire a blocking credential and the agent rejects; tamper with an event and the verification turns red.

Presented credentialseditable

category tier €12,000,000 · €5,000,000 falls short → conditional (value-capped)

Stress the inputs

Press Run the agent to qualify the supplier in your browser — the same deterministic logic that runs in CI, so the trace, the conditional outcome, and the hash-chained events are byte-identical to the repository’s. Then raise the financial cap to 12,000,000 and watch the conditional resolve.

The agent declares its capabilities through an A2A Agent Card: verify.credential, qualify.supplier. Both are bounded by the Mandate.

Why the conditional outcome matters

The judgement ordinary onboarding tooling can't make

A yes/no pipeline rejects this supplier or waves them through. Neither is right. The valuable, real-world outcome is “qualified, but capped pending a check” — derived from policy plus credentials, under governance, with the limits recorded as machine-readable conditions a downstream sourcing agent must honour.

Deterministic by design

This is the deterministic reasoner — its logic is fixed, so the conditional outcome is identical on every run, which is what makes it a proof rather than a one-off. A live frontier model can drive the identical flow with no change to the governance (mandate gate, object production, provenance, tamper-evident chain, conformance pass). The verification keys off credential types and proofs, not a fixed schema of forms: swap any proof to an issuer-signed credential and the decision is unchanged.

Concert

The first GUILD. The first SIGNET.

Concert is building the open infrastructure layer for a new era of governed, intelligent, multi-party commerce. Join the founding consortium.

Get in touch