# Overview

This sequence diagram shows:

<figure><img src="https://3186653883-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKStqIQf1dpHR3dUJNzVf%2Fuploads%2F9uBq2fIgCfY1FO6gI8oP%2Fmermaid-diagram-2025-11-16-175938.png?alt=media&#x26;token=36d247ca-5c4e-4a6c-9ec1-1d4db0edffe7" alt=""><figcaption></figcaption></figure>

* **Registration Phase**: Bot operator publishes signature-agent card to OpenBotRegistry
* **Request Phase**: Bot signs HTTP request with private key; origin server queries OpenBotRegistry directly for the signature-agent card to get public key
* **Verification**: Origin server validates signature using public key from agent card, then policy engine evaluates intent and scopes