GABA Standard
Certificate Issuance — Governed AI Boundary Attestation
cs.gaba
Issue GABA Certificate
Subject
A unique identifier for this governed entity. Typically a domain or subdomain (e.g. identity.chandrahub.net), but can be any structured identifier — an agent ID, a system name, or a named principal.

Does not need to resolve. Governance precedes existence — the cert authorizes the entity to come into being.
  • genesis — bootstrap a new Chandra chain. Must be issued first.
  • hub — governs spokes, enforces suspension.
  • spoke — domain deployment, one per customer.
  • agent — AI agent or skill. No agent runs without this.
  • marshaller — sole reinstatement authority after Andon suspension.
  • human-principal — named person in the governed namespace.
  • edge — adversarial graph computation boundary.
genesis
hub
spoke
agent
edge
human-principal
marshaller
Additional hostnames this cert is valid for, one per line. The CN is added automatically.
  • Use wildcards for spoke deployments: *.chandrahub.net
  • Leave blank for agent and human-principal certs.
Cert Profile
  • Agent / AI boundary (2.x) — default. GABA boundary cert for AI agents, spokes, hubs.
  • Tenant (3.x) — organizational identity cert. Issued to the tenant entity, not a person. Required before any principal can be created.
  • Bootstrap principal (4.x) — Steward cert. Issued to the first admin human for a tenant. Carries proofing and liability CU references.
Agent / AI boundary (2.x)
Tenant (3.x)
Bootstrap principal (4.x)
GABA Governance
  • L1 Declaration — self-asserted, no external verification.
  • L2 Attestation — third-party attested, no chain audit.
  • L3 Verification — Chandra chain present, CU verified.
  • L4 Certification — CA-issued, full governance chain.
  • L5 Audit — auditable, haltable, kill-switch enrolled.
Most production certs start at L3 or L4. Genesis certs are L4.
L1 — Declaration
L2 — Attestation
L3 — Verification
L4 — Certification
L5 — Audit
  • governed — full governance, Andon-enrolled, Marshaller-managed.
  • attested — ABRAR present, chain-referenced.
  • monitored — Chandra writing, not fully governed.
  • provisional — bootstrapping or transition state.
  • isolated — no external chain access, local audit only.
governed
attested
monitored
provisional
isolated
Chain Reference
The Chandra hub or spoke holding the audit chain for this cert.
  • Hub-level certs: chandrahub.net
  • Domain deployments: chandrahub.net/spoke/cs.gaba
Embedded in the cert so examiners know where to pull the chain. gaba_chain_ref (CU id) is auto-generated by the pre-issuance write.
The Chandra CU id of the CA’s own governance record. Links this cert back to the authority chain of the CA itself.
  • Use the cu_id from the genesis cert issuance once bootstrapped.
  • PROVISIONAL:genesis is acceptable during bootstrap.
Comma-separated list of tools or AI endpoints attested at issuance.
  • Agent certs: list specific model endpoints, e.g. claude-sonnet-4,gpt-4o
  • Hub/spoke certs: list infrastructure tools.
  • Use none if no specific tools are attested at issuance time.
Certificate Metadata
Stored in OID 1.3.6.1.4.1.65823.0.1 on every GABA cert regardless of profile. Allows any relying party to identify the cert tier without knowing the full OID arc mapping. Set automatically based on the selected profile.
GABA cert schema version. OID 1.3.6.1.4.1.65823.0.2. Current version is 1.0. Increment when the extension schema for this profile changes in a breaking way.
Comma-separated publication references governing this cert profile. OID 1.3.6.1.4.1.65823.0.3. Embedded in the cert so auditors see the governing standards without a separate lookup.
Chandra CU id of the CA's own governance record. OID 1.3.6.1.4.1.65823.0.4. Links this cert to the CA's chain-backed authority record. Use PROVISIONAL:genesis during bootstrap.
How long the cert is valid.
  • 8760 = 1 year (recommended for most certs)
  • 720 = 30 days (tighter governance for agent certs)
The Chandra chain is permanent regardless of cert expiry — the audit record survives renewal.
Pre-issuance CU written to Chandra before cert exists.
Issuance Result
■
Awaiting issuance