> For the complete documentation index, see [llms.txt](https://rwapact.gitbook.io/whitepaper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rwapact.gitbook.io/whitepaper/the-five-layer-pact/kso-session-oracle.md).

# KSO, Session Oracle

How KSO validates that an autonomous agent is acting within its active session, delegated authority, budget, and asset scope.

## KSO, Session Oracle

A valid agent identity is not enough. RWAPACT also needs to know whether that agent is currently authorized to act.

KSO is the authorization-context layer of the Five-Layer Pact. It validates the session and delegated authority behind a trade request.

```
Agent Identity
  -> Session
  -> Trade Request
  -> KSO Validation
```

An agent may have permission to trade in general. That does not establish authority for every session, budget, asset, or trade size. KSO checks the requested action against the active session context.

### Session context

| Property           | Contribution to validation                              |
| ------------------ | ------------------------------------------------------- |
| Session ID         | Identifies the delegated session.                       |
| Agent ID           | Binds the session to the acting agent.                  |
| Owner              | Identifies the session owner and revocation authority.  |
| Start time         | Defines when delegated authority begins.                |
| End time           | Defines when delegated authority ends.                  |
| Budget             | Sets the session's permitted spend.                     |
| Spent amount       | Tracks spending already used within the budget.         |
| Asset scope        | Defines permitted assets, or `all`.                     |
| Maximum trade size | Caps a single trade during the session.                 |
| Status             | Represents `Active`, `Paused`, `Revoked`, or `Expired`. |

Together, these fields define the authority granted for a bounded period. KSO tests the request against that authority before it contributes its result to the Pact.

### Validation checks

```
1. Session exists and is Active
2. Current time is within Start and End
3. Spent + trade amount <= Budget
4. Asset is in scope, or scope is "all"
5. Trade amount <= Max trade size
6. Session has not been revoked by the owner
7. Agent ID matches the session owner
```

The checks confirm that authority exists now, covers the requested asset and amount, and belongs to the requesting agent. A failed check produces a session rejection for the broader Pact decision.

`Paused`, `Revoked`, and `Expired` sessions do not provide active delegated authority. An owner can also revoke a session before its scheduled end time.

### Why session boundaries matter

Consider an owner who delegates an agent a session with a fixed time window, USDG budget, asset scope, and maximum trade size. The agent later submits a trade after the session expires.

The transaction parameters may remain technically valid. KSO rejects the request because the delegated authority is no longer active. This boundary separates capability to construct a trade from authority to make it.

### ERC-8004 and identity

The specification uses ERC-8004 agent identity and reputation registries for agent identity context. KSO uses that identity as part of session validation.

ERC-8004 does not perform KSO's complete session authorization. KSO owns the session logic and evaluates whether the identified agent can act within the current delegation.

### Session validation flow

```
Trade Intent
  |
  v
Identify Agent
  |
  v
Load Session Context
  |
  v
Check Time / Budget / Scope / Size / Status
  |
  v
Session Pass or Session Reject
  |
  v
Return Result to Pact
```

KSO returns an authorization-context result. The Pact still evaluates risk, policy, and gas conditions before execution authorization.

Common rejection cases include:

* The session has expired or was revoked.
* The trade would exceed the remaining budget or maximum trade size.
* The asset is outside scope, or the agent ID does not match.

### Scope of KSO

KSO answers one question:

> Is this agent authorized to perform this action within the current session?

It does not determine RWA risk or policy configuration. Those policy boundaries are evaluated by [KPV, Policy Vault](/whitepaper/the-five-layer-pact/kpv-policy-vault.md).

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://rwapact.gitbook.io/whitepaper/the-five-layer-pact/kso-session-oracle.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.