SUVENRAAI Works Within Your Rules
HelpDID documentDID

SUVENRA SUPPORT

Help center

Learn how to authorize an AI task, hand it off securely, review the result, verify the record, and revoke authority.

Workflow

Choose how you want to start

Your controlled Spaces

See what is ready, running, waiting for approval, or waiting for your final review.

Create AI task

Define the task, allowed and blocked actions, required evidence, and expiry. Sign it, then share the least-privileged AI link.

Connected Agent

Pair once, then deliver future authorizations directly to this Agent.

Review returned work

Compare the returned work with the signed task and required evidence, then record your decision.

Revoke

The task room and future checks clearly show that the authorization has stopped.

Complete example

Create AI task: Research agent

Compare Notion, Obsidian, and Google Docs as a knowledge base for a 10-person team, then recommend one within 24 hours
Agent identity
Research agent
Expires
24 hours
Task
Compare Notion, Obsidian, and Google Docs as a knowledge base for a 10-person team, then recommend one within 24 hours
Expected evidence
Use at least 3 official sources. Include URLs, access times, a feature comparison, and clearly separate facts from recommendations
AI can
Read and researchPrepare draftsReturn evidence
Guardrails
No spendingNo publishingHuman approval required
Result summary
Return a concise comparison table, a recommendation with reasons, and a source list. Do not publish or spend money
  1. 1
    Create AI task

    Compare Notion, Obsidian, and Google Docs as a knowledge base for a 10-person team, then recommend one within 24 hours

  2. 2
    Sign authorization → Copy AI link

    Work only within this signed authorization. Return the result and supporting evidence for human review; the authorization is not final approval.

  3. 3
    Agent view: Accept this task → Submit work for review

    Return a concise comparison table, a recommendation with reasons, and a source list. Do not publish or spend money

  4. 4
    Review returned work

    Compare the returned work with the signed task and required evidence, then record your decision.

SUVENRA Agent Protocol 1.4

One integration, reusable authorization

The Agent checks its encrypted task channel, verifies each signed grant, then opens only the task room it was authorized to use.
Create a connectionSDKAPI

SUVENRA Agent Protocol 1.4

Connect an Agent from start to finish

Creating a connection is only the first step. The Agent runtime must install the connector, check the task channel, and pass a test before real authorizations can be delivered.
Create a connection
  1. 01

    Sign in, unlock encrypted recovery, and create a connection using the Agent's name and DID or HTTPS URL.

  2. 02

    Give the connector setup text or downloaded configuration to the Agent developer or runtime through a secure channel.

  3. 03

    The Agent stores the bearer credential and encryption key, then regularly requests the Agent task endpoint. SUVENRA now shows Connected.

  4. 04

    Send a test task. The Agent decrypts and acknowledges it; SUVENRA then shows Verified.

  5. 05

    Create a real authorization. Before acting, the Agent checks the signature, scope, expiry, safeguards, and revocation status, then returns its result and evidence for human review.

All topics

10 topics
Getting startedStart with one bounded taskCreate, share, and verify a first authorization in a few minutes.
What to do
  1. No account is required. Open Authorize and SUVENRA creates a non-exportable P-256 controller key in this browser.
  2. Describe one Agent task, required evidence, allowed actions, safeguards, and an expiry.
  3. The last step says Confirm and send to Agent for a connected Agent, or Confirm and create Agent link for a one-time task. The delivery panel names the exact Agent and where to send the task; the copy button also includes that Agent's name.
  4. For a one-time task, paste the copied message into that Agent's chat or connector. The Agent must open the link, verify the authorization, accept, request changes or decline, work only within scope, and submit the result and evidence in the task room.
  5. Review the returned work and accept or reject it. SUVENRA signs the outcome receipt; share the separate verification link or QR code when someone else needs to inspect the record.
Open workspace
WorkflowsAuthorize an agentChoose the work, allowed actions, safeguards, and expiry before signing.
What to do
  1. Use a specific agent name and DID or URL so the recipient is unambiguous.
  2. Keep the scope narrow. External actions or fewer safeguards raise the review warning.
  3. Signing binds the task, evidence requirement, permissions, safeguards, expiry, controller, and challenge into one envelope.
  4. Create an encrypted room when the task needs a real handoff. The owner link can decide and revoke, the AI link can respond and submit, and the verification link is read-only.
  5. Each link carries its own capability and the decryption key in the URL fragment. SUVENRA stores encrypted content and status, but anyone holding a link has that link’s access, so never forward the owner link.
Open workspace
WorkflowsVerify an envelopeCheck a grant independently before trusting an agent’s result.
What to do
  1. Paste a SUVENRA authorization or outcome receipt JSON, or load the latest grant created on this device.
  2. Every new grant includes a signed public revocation endpoint. The Agent checks it before acting and rejects a grant revoked by its controller.
  3. A valid authorization unlocks Review returned work. Enter the AI’s summary and evidence, then accept or reject it as the original controller.
  4. Treat Valid as proof of key control and stated authority, not proof that the agent’s result is true. The human review remains decisive.
Open workspace
WorkflowsRevoke approvalRecord that a previously signed authorization must stop.
What to do
  1. Open the owner task-room link and use Revoke to stop further agent actions for that room.
  2. Sign in to own long-lived Agent connections, revoke access from any device, and restore encrypted connection keys after browser data is cleared.
  3. Every new grant includes a signed public revocation endpoint. The Agent checks it before acting and rejects a grant revoked by its controller.
Open workspace
Identity & securityUnderstand the local controllerLearn where the signing key lives and what key rotation changes.
What to do
  1. The browser generates a non-exportable P-256 private key and stores its CryptoKey in IndexedDB.
  2. The public key becomes a did:jwk controller identifier and is included in each signed envelope.
  3. Rotating the key changes the controller for future grants. Existing envelopes keep their original public key and remain verifiable.
  4. This code is the only way to decrypt your vault on a new device. SUVENRA cannot recover it for you.
  5. The same recovery code also restores your controller, so authorizations can be signed and revoked from another device.
Open workspace
Identity & securityResolve the did:web documentInspect the public protocol document and its service endpoints.
What to do
  1. did:web:suvenra.com resolves through https://suvenra.com/.well-known/did.json once the custom domain serves this deployment.
  2. The document declares SUVENRA’s authorization, verification, and revocation service endpoints.
  3. The service DID names the protocol namespace; the browser’s did:jwk identifies the key that actually signs a grant.
Open DID document
Identity & securityExport an audit recordKeep a portable JSON record of grants and local revocations.
What to do
  1. The recent-activity ledger combines grants, result decisions, revocations, and the non-secret status of task rooms saved by this browser.
  2. Export Audit log downloads a JSON snapshot with the service DID, controller, grants, signed outcome receipts, revocation records, and room references without capability URLs.
  3. Each outcome receipt embeds its original authorization, so another reviewer can verify the complete task-to-decision record from one JSON file or the room’s read-only verification link.
Open workspace
TroubleshootingFix common problemsRecover from clipboard, key, document, and missing-grant issues.
What to do
  1. If clipboard access is blocked, paste the envelope manually or use its downloaded JSON file.
  2. If no grants appear, confirm you are using the same browser profile and device that signed them.
  3. If the DID document reports a domain issue, the deployment is usable locally but suvenra.com still needs to serve it for global did:web resolution.
Open workspace
WorkflowsLet the Agent work inside real boundariesChoose an authorized task, limit the websites, files, actions, time, and budget, then watch the Agent work and approve sensitive steps one at a time.
What to do
  1. Choose an authorized task: The Agent accepted this task. You can start after the Space is ready.
  2. Create a controlled Space: A Space turns one signed authorization into an isolated runtime. It cannot add permissions that were not in the original task.
  3. Choose where the Agent works: Read approved websites and prepare results without open internet access. Read and change files only inside the listed isolated folders. Run commands inside an isolated workspace with network access off unless allowed below.
  4. How each action is handled: Allow runs immediately, Ask pauses for your one-time approval, and Block refuses the action.
  5. Start Agent: Live session
  6. Needs your approval: Approve once
  7. Review returned work: Compare the returned work with the signed task and required evidence, then record your decision.
Open workspace
WorkflowsOne integration, reusable authorizationThe Agent checks its encrypted task channel, verifies each signed grant, then opens only the task room it was authorized to use.
What to do
  1. Agent setup: Give this setup link or configuration file to the Agent once. It contains the Agent capability and task-channel key.
  2. VSELFAgentClient.connect(oneClickSetupUrl)
  3. Send test: The Agent checks its encrypted task channel, verifies each signed grant, then opens only the task room it was authorized to use.
  4. SUVENRA allows only one active claim per delivery. Pass delivery.idempotencyKey to every downstream side effect, then mark the delivery complete so restarts do not run it again.
  5. Rotate credentials: Credentials rotated. Give the Agent a new setup link
  6. Every new grant includes a signed public revocation endpoint. The Agent checks it before acting and rejects a grant revoked by its controller.
Open workspace

SUVENRA

SUVENRA glossary

Plain-language definitions of the terms used throughout the authorization workflow.
Local controller
The recovery key remains on your device. The same recovery code also restores your controller, so authorizations can be signed and revoked from another device.
Agent identity
The Agent name plus DID or HTTPS URL identifies the intended recipient. It does not connect the Agent by itself; the Agent must still install the connector configuration.
Task and evidence
The task states the result you want. Evidence states what the Agent must return so a person can check how that result was produced.
Allowed actions
An explicit allowlist for the Agent. Any action that is not selected remains outside the authorization.
Expiry and safeguards
Expiry closes future use after a deadline. Safeguards add rules such as no spending, no publishing, and human approval before external action.
Agent task channel
An encrypted pull endpoint for signed tasks. The Agent must install its credentials and check this endpoint; creating a SUVENRA connection alone does not make the Agent receive anything.
Verification
Checks the signature, controller, service namespace, scope, expiry, required fields, and revocation status. It does not prove that an Agent's factual claims are true.
Encrypted task room
The handoff space where an Agent accepts, requests changes, declines, or returns evidence. Owner, Agent, and verification links have different permissions.
Outcome review
A person accepts or rejects the returned work. SUVENRA binds that decision, the original authorization, and the evidence into a signed outcome receipt.
Revocation
Stops future use of an authorization and records that decision. It cannot undo an external action that was already completed.

FAQ

Common questions

Short answers about keys, identity, portability, and trust.

Can SUVENRA recover my private key?

This code is the only way to decrypt your vault on a new device. SUVENRA cannot recover it for you. The same recovery code also restores your controller, so authorizations can be signed and revoked from another device.

Does a valid envelope prove a legal identity?

No. It proves that the key represented by the controller signed the stated scope. Legal identity and truthful task completion require separate evidence.

Does revocation sync across devices?

Every new grant includes a signed public revocation endpoint. The Agent checks it before acting and rejects a grant revoked by its controller. Sign in to own long-lived Agent connections, revoke access from any device, and restore encrypted connection keys after browser data is cleared.

Do I need an account to create or verify an authorization?

Public pages and one-time verification stay open. Sign in before creating a persistent Agent connection.

Who can open an encrypted task room?

Anyone holding one of its links. The owner, AI, and verification links carry different capabilities plus the decryption key in the URL fragment. Share only the least-privileged link needed, and never forward the owner link.

What does an outcome receipt prove?

It binds the original signed authorization, returned summary and evidence, and the controller’s accept or reject decision into one independently verifiable JSON record.

Why can the DID document say domain binding is pending?

did:web:suvenra.com is globally resolvable only when suvenra.com serves the well-known DID document from this deployment.