# auth.md — gsc-em.com (GreenCore Solutions Corp.)

## Posture

Public content and machine files on this surface are **open by design** — no
authentication is required to read pages, kit JSONs, llms.txt or markdown twins.
Discovery endpoints (/.well-known/*) are public.

Transactional agentic commerce is authorized at the **GSC Navigator boundary**
using **Microsoft Entra OAuth 2.0** (2-factor; caller identity stamped; a human
signs every commit — Human-in-the-Loop by design).

## Protected resource

- Resource: https://gsc-em.com
- Protected Resource Metadata: [/.well-known/oauth-protected-resource](/.well-known/oauth-protected-resource)
- Authorization server (Microsoft Entra): https://login.microsoftonline.com/54939635-2f2e-465a-8526-a907cb3c8ebd/v2.0
- AS metadata mirror: [/.well-known/oauth-authorization-server](/.well-known/oauth-authorization-server)
- Bearer tokens are presented in the Authorization header.

## Agent registration (self-contained flow)

- **Agent audience:** AI procurement agents and their operators integrating with
  the SPARKS CPG Knowledge Graph (MCP, https://mcp.cpgknowledgegraph.ai/mcp) and
  GSC Navigator for CPG retail-grocery transactions.
- **Registration endpoint:** https://gsc-em.com/#contact — the surface's live contact form
  (POST https://formspree.io/f/mnjozqpg with fields name, email, message). There is no
  self-serve dynamic client registration; every registration is human-reviewed.
- **Supported method — verified email:** GSC verifies the operator's work email
  from the registration message, then provisions credentials after review.
- **Credential use:** GSC issues **Microsoft Entra OAuth 2.0 client credentials**
  (client_credentials grant against the issuer above). Agents present the access
  token as a **Bearer token in the Authorization header** on transactional calls
  at the GSC Navigator boundary. Revocation is immediate on operator request via
  the same contact endpoint.

```json
{
  "agent_auth": {
    "skill": "https://gsc-em.com/auth.md",
    "register_uri": "https://gsc-em.com/#contact",
    "identity_types_supported": [
      "identity_assertion"
    ],
    "identity_assertion": {
      "assertion_types_supported": [
        "verified_email"
      ],
      "credential_types_supported": [
        "oauth2_client_credentials"
      ]
    },
    "claim_uri": "https://gsc-em.com/#contact"
  }
}
```

Operator: GreenCore Solutions Corp. · D-U-N-S 24-336-6774 · Microsoft AI Cloud Partner.