Author once. Every agent on Earth that touches your tenant honors it.

Before you author, look. Statement libraries get cluttered fast — duplicates, near-duplicates, statements that say the same thing in different domains. Dedupe is the policy author's discipline.

curl -H "Authorization: Bearer dv_live_..." \
  "https://dictiva.com/api/statements?q=data+retention&applies_to=agent"

Or via MCP from Claude / Cursor:

Search the dictiva-governance MCP for statements about data retention that apply to agents.

The response is filtered by applies_to (human / agent / both) and faceted by domain, lifecycle state, modality, agent-aware flag. If something close already exists, adopt or refine it — don't author a sibling.

Workbench → Statements → Search renders the same data interactively with facet drilldowns.

The full statement schema has fifteen pieces. Ninety percent of statements only need four answers — the rest fall out of those.

1. Who must do this? — applies_to: human, agent, or both. Optional actor_scope refinement (e.g. agent-workflow, service-account). The same rule may apply differently to humans and agents — say so explicitly.
2. When? — the trigger condition. "Before any commit that touches a customer-data table." "On every PR review." "When generating a report shared externally."
3. What? — the modality (must / should / may) plus the allowed/prohibited actions. The agent-guidance JSONB block carries this in machine-readable form: allowedActions, prohibitedActions, requiredApprovals, evidenceRequirements.
4. Why? — rationale plus a standardReference if one exists (NIST AI RMF, ISO 27001 control, EU AI Act article).

A minimal create call:

curl -X POST -H "Authorization: Bearer dv_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Code-reviewer agents must annotate security-relevant changes",
    "body": "Any agent acting as a code reviewer must flag changes...",
    "modality": "must",
    "applies_to": "agent",
    "actor_scope": "code-reviewer",
    "domain_id": "uuid-of-your-domain",
    "enforcement_mode": "informational",
    "agent_guidance": {
      "allowedActions": ["comment", "request_changes"],
      "prohibitedActions": ["merge", "push"],
      "requiredEvidence": ["scan_log"]
    }
  }' \
  https://dictiva.com/api/statements

Or use Workbench → New Statement for the guided form.

Enforcement is a ratchet, not a one-time decision. Each statement carries an enforcement_mode from a four-rung ladder. Start soft, observe, harden over time.

A reasonable cadence: publish at informational for two weeks, watch attestations land, ratchet to machine_readable once you see agents adopting it. The mode is a property of the statement and you can change it via PATCH at any time — agents pick up the new mode on their next MCP refresh.

Two fields define who's bound by your statement:

• applies_to — human / agent / both. The same rule may have different consequences for a human reviewer (advisory) versus an agent reviewer (machine-enforceable).
• actor_scope — optional refinement. Common values: service-account, agent-workflow, code-reviewer, customer-success. Use this to say "this rule only applies to agents acting in this role."

Example: a single statement "Cannot push to main without two approvals" might carry:

• applies_to: both (humans and agents)
• actor_scope: null (anyone)
• modality: must

While "Must run security-scan before merging" might carry:

• applies_to: agent
• actor_scope: code-reviewer
• enforcement_mode: machine_enforceable

The MCP list_applicable_policies_for_actor tool reads these fields. An agent identifying itself as actor_type: agent, actor_scope: code-reviewer gets back exactly the statements that bind it — nothing more, nothing less.

Every attestation against your statement is a verifiable claim that a specific agent has read, understood, and committed to follow it at a declared tier.

curl -H "Authorization: Bearer dv_live_..." \
  "https://dictiva.com/api/agent/attestations?statement_id=<your-statement-uuid>"

The response shows every agent that's attested, the tier they claimed, the evidence they submitted, and when it expires:

{
  "data": [
    {
      "subjectDid": "did:web:dictiva.com:agents:agent-code-reviewer",
      "commitmentTier": "T3",
      "issuedAt": "2026-04-25T...",
      "expiresAt": "2027-04-25T...",
      "evidence": [{ "evidenceKind": "skill", "reference": ".claude/skills/code-reviewer/SKILL.md" }]
    }
  ]
}

Or open Statement detail → Adoptions tab for an interactive view with adoption-over-time and tier-distribution charts.