Today, every MCP server enforces its own access rules locally — idiosyncratically, without any protocol-level way for clients to know what enforcement happened on a given call. We've drafted an RFC proposing a policy_enforcement capability declaration, a standardized decision shape, and an optional cryptographic-receipt extension.
Inherence's hosted gate is one possible reference implementation — not the canonical one. The goal is a generic primitive that any vendor can implement. The working-group conversation is the deliverable; spec language is downstream.
{ policies: [...], receipt_format: "groth16-bn254-v1", verifier_key_uri }policy_decision { kind, policy_id, receipt_id }policy_denial distinct from generic tool failureTop-level capability vs per-tool annotation? In-protocol vs out-of-protocol receipt fetch? Policy authoring format neutral, or YAML-canonical? Multi-policy server semantics? Receipt caching with what invalidation? Privacy of policy-violation details on deny?
All open. The RFC is a starting point — if the working group says "this direction is worth pursuing," next step is refinement. If it says "this belongs in a separate ecosystem layer," that's also a valid outcome.