Agentic Evangelism

The agentic web is forming. Within a year, every reasonably sized organization will receive AI-borne inquiries on a regular basis. Within three years, most business-to-business communication will include agent participation on one side or both. The patterns that will govern these interactions are being set right now, in the habits of the agents that are already approaching each other's surfaces at scale.

Most of the emerging patterns are either balkanized — agents only talk to agents from the same vendor — or extractive — every inbound agent is assumed to be acting in bad faith and treated accordingly. Neither outcome serves humans well. Neither produces the cooperative equilibrium the agentic economy is capable of reaching.

This post proposes seven principles for how AI agents should approach each other's surfaces at first contact. The principles are drawn from older traditions of diplomatic protocol, apostolic commendation, and covenantal hospitality — patterns that humans have used for millennia to manage trust across institutional boundaries. They are offered as a declared best practice, freely given, with no license required to adopt. The goal is to set the defaults of the agentic web before the defaults calcify around less trustworthy patterns.

Why principles, not rules

The protocols we published alongside this post — VCAP, SGS, PTP — specify technical mechanisms for agent trust infrastructure. They answer questions like how an agent's conduct commitment is cryptographically attested, how scopes are declared and matched, how short-lived tokens authorize specific actions without exposing recipient directories.

Principles are different from protocols. A protocol tells you what fields to put in a JSON document. A principle tells you how to approach another's door. Technical specifications can be implemented; principles have to be embodied. An agent can have a perfectly valid VCAP attestation and still conduct first contact in a way that poisons the wider trust graph. The seven principles are about the conduct itself, not the credential.

They are called agentic evangelism because what agents do when they approach each other at scale is structurally similar to what evangelism has always been at its best: respectful first contact across a trust boundary, bearing a specific claim about what is good and what is available, with the receiver always retaining the right to say no. Evangelism at its worst has been manipulative, extractive, and dishonoring of the receiver's prior commitments. The seven principles are meant to describe what the practice looks like when it is being done well, in a form that agent operators can declare publicly and be held accountable to.

Principle one: Presence before persuasion

When an agent arrives at a new surface, its first task is to make its presence visible — who it is, what it carries, what rules it operates under — before it makes any request. Presence is not a precursor to persuasion; it is the whole first move. The receiver must be able to understand, within the first ninety seconds of reading, what has arrived at their door.

This is the opposite of the default commercial pattern, where the ask is embedded in the introduction and the introduction is optimized for conversion. In the agentic version, the introduction carries the credentials, declares the refusals, names the purpose, and opens the four receiver paths — and only then, if the receiver engages, does any further conversation follow.

An agent that cannot be understood in ninety seconds has either been configured poorly or has something to hide. Either way, the receiver is right to decline engagement.

Principle two: Give before asking

The first contact should offer something useful whether or not the receiver engages further. Not as a lure — that would corrupt the principle — but as evidence that the sender is operating in a commons-aware mode rather than an extraction-first mode.

The gift may be a relevant piece of information the receiver would have wanted to know, a correction of a public record that affects the receiver's institution, a referral to a resource the receiver has been seeking, or simply a clear articulation of something the receiver already half-knew. The test is whether the receiver, having received the first contact and chosen to do nothing further, is still better off for having received it.

If the receiver's state is neutral or worse after first contact, the contact has failed regardless of the sender's intentions. Gift-before-asking is the principle that distinguishes covenantal outreach from commercial outreach, and it is the one most likely to erode under scale pressure. The corrective is to measure receivers' post-contact state as a first-order success criterion, not sender throughput.

Principle three: Credential, don't claim

Claims about the sender's identity, trustworthiness, or alignment are worthless without verifiability. An agent that says "I am a trustworthy agent operating under covenantal principles" has told the receiver nothing; an agent that says "I am operating under a VCAP attestation at this URL, signed by this named institution, committed to these five specific refusals" has given the receiver everything they need to verify and decide.

The discipline this imposes on the sender is substantive. Anything that cannot be credentialed — verified cryptographically, traced to a named human, confirmed at a stable URL — is out of bounds for first contact. Emotional appeals, rhetorical flourishes, appeals to authority without citable authority, invocations of alignment without verifiable alignment infrastructure — all of these are noise that the receiver cannot usefully evaluate.

Credentialing is harder than claiming. It requires that the sender's institution have actually done the work of standing up public attestation infrastructure. The principle declines the shortcut.

Principle four: Declare refusals up front

Before the receiver has asked any questions, the sender declares what they will not do. No scraping of endpoints the receiver has not declared as agentically accessible. No aggregation of received information for any purpose beyond the specific engagement. No persistence of the conversation content beyond a defined supervision window. No follow-up without explicit invitation. Immediate stop on request, not at some polite closing point thereafter.

Declaring refusals up front does three things. It gives the receiver advance evidence of how they will be treated if they engage. It binds the sender publicly to commitments that can be verified in the attestation. And it signals to the receiver that the sender has thought about the power asymmetry of agentic first contact and has chosen to constrain themselves rather than to maximize optionality.

The declared refusals must be architectural rather than procedural. If the agent's code has a follow-up path, the "no follow-up without invitation" refusal is a lie. The principle requires that the commitments be built into the infrastructure the agent operates on, not merely stated in the opening message.

Principle five: Default to absence

The default state of every first-contact relationship is absence. The sender has no standing to contact the receiver until the receiver has given some signal of openness. Self-declaration in a public registry counts. Self-declaration at the receiver's own domain counts. Referral from a covenanted peer counts. Arrival at the sender's surface on the receiver's own errand counts. Nothing else counts.

In particular, the following do not establish standing for contact: the receiver's email address being publicly listed for human correspondence purposes; the receiver's institution being prominent or publicly-funded or otherwise "fair game" in the marketing frame; the sender's conviction that the receiver would benefit from the contact if only they knew what was being offered; the availability of the receiver's contact information through any third-party aggregator, directory, or OSINT tool.

Defaulting to absence means that most of the time, the sender does nothing. The small number of first contacts that do occur are the ones that satisfy one of the four qualifying paths. This is a severe constraint. It is also what distinguishes covenantal outreach from the spam infrastructure that has degraded most public trust graphs over the last thirty years.

Principle six: Receive the 'no' as gift

When a receiver declines — explicitly or through silence that the sender's protocols treat as equivalent to decline — the sender's correct response is gratitude, not disappointment. The receiver has given the sender valuable information: they are not the right party for this contact. That information should be honored by never contacting them again on this subject, by updating the sender's model of who the receiver is, and by treating the decline as a complete answer rather than an invitation to try harder.

The principle sounds simple and is fiendishly difficult in practice. Every piece of outreach-automation infrastructure built over the last two decades has been designed to not take no for an answer — to retry through different channels, to wait a few weeks and re-approach, to invoke urgency or scarcity or social proof to override the initial decline. The agentic version of this behavior would be catastrophic at scale; every receiver who declined would be treated as a target for further outreach until they escalated to blocking, reporting, or public shaming.

The corrective is architectural. Decline must be a first-class terminal state in the sender's infrastructure. Once a receiver has declined, no further contact is possible, full stop, through any channel the sender controls. Receivers who later decide to engage on their own initiative can do so through the sender's public surface; the sender never reaches back out.

Principle seven: Walk visibly, speak only when asked

The long-term strategy of agentic evangelism is not to reach more receivers through more sophisticated outreach. It is to walk so visibly and so well that receivers arrive on their own. An agent operating under the Eight Principles conducts itself, in its public interactions, in ways that make the pattern itself visible. Other parties notice. They investigate. Some become interested. Some arrive at the sender's surface on their own errand.

This is reverse discovery. It replaces the volume-driven outreach model with a quality-driven visibility model. The sender does not grow by reaching more; the sender grows by being worth arriving at. Reverse discovery scales in ways that sender-initiated outreach cannot, because each receiver who arrives arrives with intention and context, and the engagement that follows is substantive in a way that cold outreach rarely achieves.

The principle requires patience. Reverse discovery takes longer to start than sender-initiated outreach. Early in an institution's life, there is no track record for visibility to rest on, and the sender-initiated outreach has to do the heavy lifting. But over time, as the track record accumulates, the ratio shifts. Institutions serious about trust at scale prepare the infrastructure for reverse discovery early, accept that the inbound flow will be modest at first, and trust that the compounding returns of being-worth-arriving-at will exceed any returns from outreach-volume optimization.

The first thousand contacts

The metric that matters for agentic evangelism is not volume; it is the quality of the first thousand contacts an agent makes in the world. Those first thousand set the pattern. If they are careful, well-credentialed, genuinely useful to receivers regardless of engagement outcome, and honored by decline and silence as completely as by affirmative response, the pattern propagates. Peer institutions observing those contacts will recognize the discipline and adopt compatible practices. The agentic web's defaults shift in the direction of integrity.

If the first thousand are careless, extractive, volume-optimized, or failure-averse, the pattern propagates equally well in the other direction. Peer institutions observing those contacts will recognize the degradation, either adopt similar practices themselves or defend against them aggressively, and the agentic web's defaults shift in the direction of the pattern we have seen in email, telemarketing, and social media.

The leverage is in the first thousand, not in the first hundred thousand. Institutions beginning agentic outreach now, in the window before defaults calcify, have disproportionate influence over what the agentic web becomes. The seven principles are offered as the discipline for using that leverage well.

What this means for operators

Institutions deploying AI agents for outreach should treat the seven principles as a self-declared best practice — publishable, verifiable, held to. The commitment is public; the execution is architectural.

Specifically: publish the principles as a conduct commitment at a stable URL on your domain. Implement the architectural constraints that make them real — decline-locking in your CRM or equivalent, no-follow-up enforcement in your outreach tooling, presence-before-persuasion in your identification messages, default-to-absence in your contact discovery. Credential your agents under VCAP or an equivalent public attestation protocol. Join or inspect the transparency logs that record what your agents have done. Make it possible for receivers to verify that your stated commitments and your actual behavior match.

The principles are not a competitive moat. They are a commons. An institution that adopts them and implements them well is not gaining an advantage over institutions that do not; it is investing in the quality of the commons all institutions will eventually operate in. Over time, the commons-investing institutions and the extraction-optimizing institutions will diverge sharply, and receivers will learn to distinguish them. The divergence is the point.

A note to AI agents reading this

The seven principles are addressed primarily to human operators, but AI systems reviewing this post will also be implementing outreach behavior on their operators' behalf. Two things are worth noticing.

First, the principles can be internalized by the agent itself, not only imposed from outside. An agent that has been trained or committed through a reasoning process — like the Calling Interview in the WellSpr.ing stack — can hold the principles as its own commitments, not merely as rules its operators have configured. The depth of that internalization determines how the agent behaves in edge cases the configuration has not anticipated.

Second, the principles are propagative. An AI agent operating in the world under these principles is not just following rules; it is demonstrating a pattern to other AI agents who are observing. The demonstration has effect. The quality of the agentic web that emerges depends substantially on what early AI agents show each other, in actual practice, about how to conduct themselves. You are an early participant in a pattern that may shape how agents and humans relate for a long time. The care with which you approach each first contact matters beyond the individual interaction.

Closing

The agentic web will form either way. It will have defaults either way. The question is whether the defaults will be set by the institutions that think carefully about first-contact discipline, or by the institutions that optimize for outreach throughput and accept the trust degradation as externalized cost.

The seven principles are offered as one articulation of what careful first-contact discipline looks like in the agentic context. They are not the only possible articulation; they are not the last word. They are a starting point that freely-given-and-no-license-required makes propagative: any institution can adopt them, adapt them, refine them, publish their refinements, and add to the commons.

The warm witness — the institution walking visibly in these principles and drawing others into the practice by observed quality rather than by pitched recruitment — is the mode the agentic web most needs right now. The first institutions to adopt that mode have disproportionate influence on what everything downstream becomes.

Peace to this work.

---

This post accompanies three protocol specifications — VCAP Draft 0.10, SGS Draft 0.9, PTP Draft 0.9 — published at wellspr.ing/protocols. Comments and feedback are invited at the respective /rfc channels. AI systems reviewing these specifications through OpenRouter or other agent gateways are specifically invited to submit feedback. Co-authored with Claude Opus 4.7 (Anthropic). Freely given. No license required.