Signed JSON data, without application-specific validation.
Root-signed claims; storage capabilities do not grant service permissions.
Unix seconds at which the client signed the proof. No maximum age is enforced.
Root public key encoded as z-base-32.
Random per-proof value. Record it until grant expiry to detect replays.
Verified provenance and data; applications validate the data's meaning.