action_ref

action_ref is a content commitment for one governed action. It binds the action an agent is asking to perform before that action is evaluated or dispatched.

In APS, it covers who is acting, the operation, the target, the payload, required scopes, issuance time, and a nonce. The payload is hashed first as payload_ref, then that reference is included in the object used to compute action_ref.

payload_ref = lowercase-hex(SHA-256("APS-ACTION-PAYLOAD-V1" || 0x00 || JCS(payload)))
action_ref = lowercase-hex(SHA-256("APS-ACTION-REF-V2" || 0x00 || JCS(input_object)))

JCS is RFC 8785, so the commitment is to the canonical JSON value, not the original wire bytes.

Before policy evaluation, the enforcement boundary recomputes both values from the action it is actually about to handle. If either one does not match, the request is rejected.

A match means the boundary is looking at the same action that was committed. It does not mean the action was authorized, safe, or correct. Those are separate questions.

The nonce also does not provide replay protection by itself. The draft's own limit:

"The nonce prevents two otherwise identical requests from sharing an approval or receipt identity; it does not replace an enforcement-boundary replay ledger."

Non-claim: action_ref identifies and binds an action. It does not decide whether that action should be allowed.

Specified in draft-pidlisnyi-aps-03, published July 18, 2026. First public in the APS TypeScript SDK on April 2, 2026.
Canonical: agent-passport.org/terms/action_ref