AIP-23 proof kinds: secret-access (a secrets service judged one request on a named secret: verdict, rules, presented identity and policy by digest; never the value); 17 kinds

aips/aip23-kinds/KINDS.json

@@ -475,6 +475,69 @@
    "added": "2026-09-28",
    "vector": "provenance.json"
   },
+  {
+   "kind": "secret-access",
+   "statementKind": "aere-proof-of-secret-access",
+   "envelopeKind": "aere-proof-of-secret-access-attestation",
+   "fields": [
+    {
+     "name": "presentationHash",
+     "type": "digest",
+     "note": "sha256 of the content, 0x + 64 hex"
+    },
+    {
+     "name": "policyHash",
+     "type": "digest",
+     "note": "sha256 of the content, 0x + 64 hex"
+    },
+    {
+     "name": "service",
+     "type": "plain"
+    },
+    {
+     "name": "secret",
+     "type": "plain"
+    },
+    {
+     "name": "version",
+     "type": "plain"
+    },
+    {
+     "name": "operation",
+     "type": "plain"
+    },
+    {
+     "name": "verdict",
+     "type": "plain"
+    },
+    {
+     "name": "rules",
+     "type": "plain"
+    },
+    {
+     "name": "grant",
+     "type": "plain"
+    },
+    {
+     "name": "holder",
+     "type": "plain"
+    },
+    {
+     "name": "presenter",
+     "type": "plain"
+    }
+   ],
+   "required": [
+    "service",
+    "operation",
+    "verdict",
+    "presentationHash",
+    "createdAt"
+   ],
+   "attests": "a secrets service judged one request (put, get, rotate, revoke or grant) on a named secret and version: the verdict and the rules that decided it, the presented identity (presentation digest), the holder and presenter, the grant and the policy (digest); never the value",
+   "added": "2026-10-18",
+   "vector": "secret-access.json"
+  },
   {
    "kind": "ai",
    "statementKind": "aere-proof-of-ai",

aips/aip23-kinds/README.md

@@ -40,6 +40,7 @@ ABSENT). Change one field of a statement and it is INVALID at the integrity leve
 | authorization (added 2026-09-28) | `aere-proof-of-authorization` | `grantor`, `grantee`, `scope`, `createdAt` | a grantor gave a grantee the right to act within a scope, under a policy (digest), until an expiry |
 | settlement (added 2026-09-28) | `aere-proof-of-settlement` | `chainId`, `txHash`, `blockHash`, `amount`, `asset`, `createdAt` | a settlement on a chain: its transaction and block (32-byte hashes carried as they are, never re-hashed), amount and asset |
 | provenance (added 2026-09-28) | `aere-proof-of-provenance` | `subjectHash`, `parents`, `createdAt` | an artifact (digest) was produced from a non-empty list of parents (digests), by a process (digest), by an actor |
+| secret-access (added 2026-10-18) | `aere-proof-of-secret-access` | `service`, `operation`, `verdict`, `presentationHash`, `createdAt` | a secrets service judged one request (put, get, rotate, revoke or grant) on a named secret and version: the verdict and the rules that decided it, the presented identity (presentation digest), the holder and presenter, the grant and the policy (digest); never the value |
 | ai | `aere-proof-of-ai` | `model.name`, `createdAt` | an AI action: which model and version, which prompt, input and output (digests), which tools, which agent, who asked |
 | agent-decision (added 2026-09-29) | `aere-proof-of-agent-decision` | `policyHash`, `action`, `decision`, `createdAt` | an AI agent action was judged against a policy (by its hash): allowed or refused, and why; the action by the digest of its canonical JSON |
 

aips/aip23-kinds/secret-access.json

@@ -0,0 +1,21 @@
+{
+ "v": 1,
+ "kind": "aere-proof-of-secret-access-attestation",
+ "statement": {
+  "v": 1,
+  "kind": "aere-proof-of-secret-access",
+  "presentationHash": "0x6e36fd65925c49ec4f04faa69ea1c9c656f8f182706b59788b5fd98f6d9a9f9c",
+  "policyHash": "0xf062025b73d9324b189fcec2b5c88338aa6fa9fb7877700681b2049b57e6aedd",
+  "service": "https://secrets.example",
+  "secret": "db-password",
+  "version": 2,
+  "operation": "get",
+  "verdict": "allowed",
+  "rules": [],
+  "grant": "deployers",
+  "holder": "aere-id:0000000000000000000000000000000000000000",
+  "presenter": "aere-id:1111111111111111111111111111111111111111",
+  "createdAt": "2026-09-26T00:00:00Z"
+ },
+ "statementHash": "0xcb48955f43aa3108fea9deecaeb14240287e253b4ab97fb27a07fd7fa36c9bee"
+}