# Explore the foundations

Choose a capability and continue to its repositories and setup instructions.

## Authorization and execution

Bind operations to explicit targets, expiry and permissions across process and network boundaries.

[Libraries and usage](https://crowsi.org/capabilities/authorization)

[authorized-execution](https://github.com/crowsi-net/authorized-execution) — Policy, target binding, expiry, revocation and authorized execution boundaries.

[crowsi-auth-routing](https://github.com/crowsi-net/crowsi-auth-routing) — Use the same validated authorization route declarations across an application and its MCP interface.

## Credential custody

Separate credential custody, limited use, device transfer and recovery.

[Libraries and usage](https://crowsi.org/capabilities/credentials)

[credential-custody](https://github.com/crowsi-net/credential-custody) — Credential and device authority, constrained usage, recovery and OS backends.

## Observations and telemetry

Collect scoped security evidence and service telemetry with explicit disclosure boundaries.

[Libraries and usage](https://crowsi.org/capabilities/observability)

[security-observations](https://github.com/crowsi-net/security-observations) — Scoped sensors, evidence and reusable security observations.

[crowsi-service-telemetry](https://github.com/crowsi-net/crowsi-service-telemetry) — Retain service-owned operational signals and publish only an explicitly allowed projection.

## Process communication

Exchange bounded messages between local processes with framing and timeout handling.

[Libraries and usage](https://crowsi.org/capabilities/transport)

[crowsi-transport-foundation](https://github.com/crowsi-net/crowsi-transport-foundation) — Exchange bounded messages between local processes without building framing and timeout handling again.

Canonical: https://crowsi.org/capabilities