Document Participants

Two independent dimensions describe everyone present.

Dimension one: what kind of actor

• Humans act through providers that verify them — Alice through MyOS, a merchant through their bank's business Timeline, an official through a registry. The document trusts the provider's attribution, never a payload's self-description.
• Services are full participants, not just endpoints: they hold their own Timelines, call Operations through SDKs, and answer requests. MyOS makes this practical — presenting Operations as actions, submitting attributable requests, tracking state — but convenience never bypasses the model: a button click still becomes an attributed Timeline Entry.
• Agents are first-class, and this is where the model earns its keep. Shared credentials erase the distinction between Alice acted, Alice's agent acted, and something unknown used Alice's password. An agent in Blue has its own identity, runtime attribution, provider, and history — it never borrows a human's credentials. And agents can hold Mandates. (So can humans and services — but agents are why you'll care.)

Documents can then legislate the boundary between human and automated action directly, with an Actor Policy:

contracts:
  actorPolicy:
    type: Actor Policy
    operations:
      authorizeFunds:
        requiresActor: principal    # a human must do this
      addNotes:
        requiresActor: any          # automation welcome

An agent attempting authorizeFunds is refused by the document itself, regardless of any Mandate. This is what changes the shape of the AI-trust question. "Do I trust this AI's internal reasoning?" is unanswerable. "Do I trust this provider's attribution, and are these boundaries right?" is a question institutions have been answering for centuries — and every action, allowed or refused, leaves attributed evidence.

Alongside actor kind, each entry records source — browser session, API call — and authority separately. An agent truthfully identified, arriving through a legitimate API, may still be refused for lacking a Mandate. Three facts, never conflated.

Dimension two: what role in the document

• Parties carry the relationship itself — customer and merchants in an agreement, payer and payee in a payment, authority holder and authorized actor in a Mandate. Their channels bind the operations that are the relationship.
• Helpers support a party: Alice's booking agent, a merchant's pricing service, a lawyer, an assistant. Helpers act through their own channels under Mandates — attributed as themselves, empowered by someone else.
• Providers connect the document to the world through request-response. The document emits Legal Review Requested; the legal firm — in the real world, outside deterministic processing — does the work, and answers Legal Review Succeeded or Legal Review Failed through its own Timeline. Payments, deliveries, identity checks, external computation: all the same pattern. This is Blue's honest boundary with reality — the document doesn't pretend to review contracts; it makes the request, the response, and the reaction exact.

The dimensions cross freely. One agreement's cast:

Same person, different documents, different roles: Alice is a customer here, a merchant elsewhere, an authority holder in her agent's Mandate. Roles live in documents, not in identity records — which is exactly where reality keeps them.

And the cast isn't fixed at creation. Adding a legal provider is a document transition like any other: a new channel appears in the diff, with exact before-and-after identity, caused by an attributed event. Nobody edits a permission table in the night.