Credentials the brand holds

Not every credential is a person's. A brand that files with a government office may file under its own registration, and the rules can reserve an act to it, so no person needs to hold it and the AI still does the work. The brand holds the credential, a verifier keeps it fresh, and the gate checks it before the act.

Declare it, then reserve to it

Brand({ credentials }) names each credential the brand holds, with the verifier that checks it:

Run

cat brand.ts

magic values: metadata.sandbox.brand = verified, metadata.sandbox.brand = stale

import { Brand } from 'services.dev'

// A filing brand that e-files under its own e-file number: a credential the brand itself holds,
// verified by its own verifier and kept fresh. On a test key the sandbox stands in for the verifier.
export default Brand({
  domain: 'filings.example',
  credentials: { efin: { verify: 'https://verify.example.test/efin', fresh: '30d', via: 'the e-file application' } },
})

A rules row reserves the act to it with { reserved: { brand } }:

Run

cat rules.ts

magic values: metadata.sandbox.brand = verified, metadata.sandbox.brand = stale

import { Rules } from 'services.dev'

// The brand's counsel reserves the e-filing to the brand's own credential, not a person's.
export default Rules({
  version: '2026-10',
  services: {
    extension: { file: { reserved: { brand: 'efin' }, where: '*', position: "An extension is e-filed under the brand's own e-file number." } },
  },
})

check reads both:

Run

npx services.dev check

magic values: metadata.sandbox.brand = verified, metadata.sandbox.brand = stale

brand.ts · 2 lines · filings · filings.example · holds efin
  who     AI delivers every job. (rules 2026-10)
  bounds  reserved file to the brand's efin

A row can also need both a person's credential and the brand's: { reserved: 'sworn translator', and: { brand: 'registry account' } }. A row that names a brand credential brand.ts doesn't declare fails brand_credential_missing:

Run

npx services.dev check

magic values: none

brand.ts · 2 lines · lingua · lingua.example · holds registry account
  bounds  reserved sign to sworn translator, under the brand's registry account

While it is stale

An order whose act needs a credential that isn't verified and fresh answers 403 brand_unverified, charges nothing, and names the waitlist. On a test key the sandbox stands in for the verifier, so each branch runs without one:

→ POST /jobs {"service":"extension","year":2025,"max_usd":25,"key":"verified","metadata":{"sandbox":{"brand":"verified"}}}

← job_7Hq2 · delivered · form.txt · $25.00 charged
  record  form · ai | review · ai · pass | file · the IRS · efin verified · accepted · rcp_7Hq2

The record names the credential on the act it covered, efin verified, or efin simulated on a test key.

Every form

Key	What it says	Default
`credentials.<name>.verify`	The verifier: a URL or your function. The only writer of the credential's facts	required
`credentials.<name>.fresh`	How old a verification may be before the act waits, such as `'30d'`	—
`credentials.<name>.via`	Where it comes from, such as the application that issued it	none
`{ reserved: { brand } }`	A row reserved to the brand's credential	—
`and: { brand }`	A brand credential a row needs beside a person's	none

Refusals

Code	When
`brand_unverified`	The act's brand credential is unverified or stale. Nothing is charged
`brand_credential_missing`	`check`: a row names a credential `brand.ts` doesn't declare

Declare it, then reserve to it#

While it is stale#

Every form#

Refusals#

Declare it, then reserve to it

While it is stale

Every form

Refusals