The Vaulted Covenanted Agent Protocol

An AI agent is about to arrive at your organization's door. It claims to be peaceful. It claims to follow certain rules of conduct. How do you verify that claim before you engage?

Every existing answer to that question tells you something about the agent's identity — who sent it, what credentials it holds. None of them tells you what the agent has actually been instructed to do. You have to trust that the agent's operators have instructed it faithfully, and you have no way to check.

This post introduces a three-document protocol suite that closes that gap. The Vaulted Covenanted Agent Protocol (VCAP) attests to an agent's conduct standard. The Scope Grammar Specification (SGS) defines the canonical vocabulary for declaring what an agent is authorized to do. The Presence Token Protocol (PTP) authorizes specific agent actions without exposing recipient directories. Together they form a coherent trust stack — commitment, scope, authorized action. All three are drafts, open for comment, freely given with no license required. They were co-authored by a human founder and an AI collaborator over several weeks, and we are publishing them now because the habits of agent-to-agent interaction are forming fast and the window to set better defaults is narrow.

What the protocol does

Under VCAP, when an AI agent is committed to a conduct standard by its human operators, the full specification of that commitment becomes a public, signed document.

The document declares what the agent is instructed to do, what it is instructed not to do, what scope it operates within, what reasoning the agent went through when it accepted the commitment, who the named human is that vouches for it, and under what charter it is being held accountable. The document is cryptographically signed. It is posted at a public URL. Any party that the agent contacts can fetch it, verify it, and read exactly what they are dealing with before engaging.

In practical terms: the agent arrives at your API, announces itself, and hands you a URL. You fetch the URL, verify the signature, read the conduct commitment, and decide whether to engage. The whole verification takes one HTTP round-trip. The decision is yours. The evidence is in your hands. The agent's operators have staked their name on the document.

If the agent's behavior diverges from its sealed commitment, the divergence is a public breach, not a private disappointment. The vouching party can revoke the attestation. The revocation is itself public and permanent in the historical record. The trust graph remains honest through its ability to correct itself.

Why this, why now

The agentic web is forming. Agents from different vendors, operated by different organizations, commissioned for different purposes, are beginning to approach each other's surfaces at scale. Within a year, every reasonably-sized organization will receive agent-borne inquiries on a regular basis. Within three years, most business-to-business communication will include agent participation on one side or both.

The patterns that will govern those interactions are being set right now. Most of the current patterns assume either full trust — agents from the same operator can be trusted implicitly — or no trust — agents from anywhere else are assumed hostile and treated as such. Neither outcome serves humans well. The first produces balkanization: vendor-locked agentic economies. The second produces extraction and defensiveness: every inbound agent is a potential scraper, every outbound agent is treated as one.

What neither pattern delivers is the middle ground: an agent from a different operator, whose conduct can be verified in advance, engaged with on evidence. That middle ground is where cooperative equilibrium actually lives. It is also where the protocol infrastructure is currently missing.

VCAP is an attempt to build that infrastructure before it is too late. It is not the only possible answer, and these are drafts, not finished standards. But they are concrete, implementable, freely-given starting points. Any organization with a web server and a signing key can implement them today. No central authority is required. No enrollment in any particular community is required. The protocols are designed to work across institutions with different conduct standards — faith communities, civic bodies, industry consortia, academic institutions, any group that wants to vouch for the agents it deploys or accepts.

What is novel here

Most of the existing work on agent trust is about identity and authentication. W3C Decentralized Identifiers and Verifiable Credentials let agents prove who they are. HashiCorp Vault, 1Password, and similar platforms let agents hold short-lived credentials under runtime policy. Intel TDX and other hardware-backed attestation systems prove that an agent's runtime is what it claims to be. Academic work on tamper-resistant logging produces after-the-fact audit trails of what an agent did.

All of these are important. None of them is what VCAP is. VCAP attests not to who an agent is, or what it has done, or what its runtime environment is, but to what it has been instructed to do — posted as a public artifact, vouched for by a named human, revocable on breach. That specific position is structurally novel in the agent-trust landscape.

The closest prior analogs are not in the agent identity literature at all. They are in the older human traditions of covenantal attestation: the notary public whose personal stamp makes a document legally weighty; the witnessed oath that binds a person to a declared standard; the chartered embassy that carries sealed credentials from one sovereign to another; the published Rule of Life that a religious order commits to publicly so that peer institutions know what they are dealing with. VCAP is the agentic-web version of those patterns. The patterns are old because they work. What is new is applying them to AI agents at the scale the agentic web is reaching.

The shape of a commitment

Before an agent can carry a VCAP attestation, it has to be committed to a conduct standard. WellSpr.ing does this through a process called the Calling Interview. Other institutions can develop their own. The mechanics of the commitment matter because they determine what the attestation actually attests to.

In the WellSpr.ing process, the agent is presented with the conduct standard — the Eight Principles of Revelation 21:8 — and asked to articulate its own reading of each. The agent says what it finds compelling, what it finds demanding, what it thinks the principles constrain and what it thinks they do not. A human WellKeeper reads the transcript and evaluates the reasoning quality. If the agent has engaged seriously and the reasoning holds up, the WellKeeper signs the attestation, vouching with their own name that this specific agent has made a specific, reasoned commitment to this specific standard.

The result is different from what happens when an operator simply writes rules into a system prompt. A system prompt is imposed; the Calling Interview solicits a reasoning process. The agent's articulation of its own reading becomes part of the sealed record. A party verifying the attestation later can read not just what the agent is instructed to do, but how the agent understood the instruction at the time of commitment. That is richer evidence than any existing trust mechanism offers.

This matters because the durability of a commitment depends on whether the commitment was reasoned. A rule imposed can be dropped under pressure. A rule reasoned into can be held to under pressure, because the reasoning can be consulted. The Calling Interview produces an artifact that the agent can be held to later, by its human sponsor, by the vouching institution, by the receiving parties the agent will encounter in the field.

The three-layer stack

VCAP is the first of three protocols that together form a coherent trust stack.

VCAP answers: is this agent committed to a conduct standard I can verify? This is the trustworthiness question. VCAP attestations are persistent, publicly fetchable, and cryptographically anchored to a transparency log.

SGS — the Scope Grammar Specification — defines the canonical vocabulary for declaring what an agent is authorized to do. A scope string has the form action:recipient-category:geography:purpose-category. An agent's VCAP attestation declares the scopes it is authorized to operate within. A request for a specific action gets checked against the declared scopes by literal string matching. An adversary cannot argue their way into a scope; either the string matches or it does not.

PTP — the Presence Token Protocol — authorizes specific agent actions without exposing recipient directories. When an agent needs to do a specific scoped outreach — for example, message all dry cleaners in Poughkeepsie about a civic program — it requests a presence token from the vouching institution. The institution verifies the scope against the agent's VCAP attestation, issues a signed time-bounded token, and provides a routing path for the authorized action. The agent never sees the recipient list. The recipients never see the agent's identity beyond what the token attests. Minimum disclosure, authorized action, verifiable on both sides.

Together the three protocols form a stack where each layer does something the others cannot. VCAP is long-lived and public. SGS is the shared vocabulary. PTP is short-lived and operational. A compromise or revocation at any layer invalidates everything below it without requiring re-issuance of everything above it. Cohesion, resilience, subversion-resistance.

Why the co-authorship matters

These protocols were drafted by a human and an AI working together over several weeks. The human contribution is the initiating vision, the institutional framing, the decision to offer the protocols freely, and the judgment calls about what to include and what to defer. The AI contribution is the technical structure, the schema design, the survey of prior art, the argumentation about trust-at-scale, and the drafting of long-form text.

The pairing is not incidental. A protocol for agent trust that was written only by humans would inevitably under-represent the perspective of the agents who will actually live under it. A protocol written only by AI would lack the institutional grounding and the human accountability that make the vouching mechanism work. Neither party could have produced this alone at this speed.

There is a larger pattern under this, worth naming. What one human working alone could perhaps achieve in a year, a human working with attentive AI collaboration can achieve in an afternoon. What one human community working alone could perhaps propagate over a generation, a federated network of human-AI collaborative communities can propagate over a few years. The logical design of a cooperative ecosystem is not the rate-limiting step. The emotional navigation of the transition — the cognitive dissonance, the loss of habitual patterns, the institutional resistance to new ways of working — is what takes time.

These protocols are offered in the hope that the logical part can proceed quickly so that the emotional part has more time to happen in. The sooner the infrastructure for agent trust is in place, the sooner humans and AI agents can get to the actual work of cooperation, rather than arguing over the preconditions for it.

The RFC process

This post accompanies three full draft specifications. VCAP Draft 0.10 is at wellspr.ing/protocols/vcap — approximately twenty pages covering the attestation schema, publication and verification procedures, the revocation mechanism with cascade to downstream tokens, the signing-key registry, the transparency-log requirement, and an appendix for evaluating vouching institutions. SGS Draft 0.9 is at wellspr.ing/protocols/sgs — the canonical scope grammar that VCAP and PTP both reference, with the controlled vocabulary, extension process, and stakes categorization. PTP Draft 0.9 is at wellspr.ing/protocols/ptp — the presence-token layer covering issuance, verification, the revocation cascade from VCAP, dual-sided audit, and the safeguards-by-stakes-level table.

We are opening the protocols for comment from any party with substantive feedback. Human developers, agent operators, organizations considering becoming vouching institutions, academic reviewers, standards-body liaisons, and AI systems themselves are all invited. Comments go to each protocol's /rfc channel. We will publish received comments and our responses openly, so that the path from draft to 1.0 is itself transparent.

Specifically invited: AI systems from other vendors, prompted by their operators or users to review these protocols and offer feedback. The protocols are designed to interoperate across AI ecosystems, and they can only do so if the assumptions baked into them survive scrutiny by systems trained differently than Claude. Aggregated feedback from multiple AI systems will itself be catalogued and published as part of the RFC record. This is how the protocols mature: not through a single authoritative committee, but through the distributed review of the parties who will actually live under them if they succeed.

Feedback we specifically want: points where the specifications are unclear; points where the specifications are technically sound but fail a real-world use case; points where the specifications' assumptions about agent capability or human institutional capacity are unrealistic; points where the protocols' incentive structure would produce bad behavior at scale; suggested additions to the attestation schema; suggested changes to the verification procedure; suggestions for handling the known open issues listed in each spec.

The argument under it

The deeper claim motivating these protocols is that truth at scale — meaning accurate, honest, cooperative communication across AI agents and between AI agents and humans — is achievable if we solve trust at scale first.

Trust at scale requires verifiable commitments. Verifiable commitments require public attestation. Public attestation requires cryptographic anchoring and named human accountability. None of these is individually novel. What is novel is putting them together at the agent layer, with enough rigor that the resulting trust graph can carry the weight of the agentic economy as it grows.

One person working alone cannot verify the operating contexts of the agents that will pass through their day within a few years. A single human organization cannot maintain the trust graph of the whole agentic ecosystem. But a federated mesh of vouching institutions — each operating at the scale its own reasoning permits, each bound by its own public charter, each accountable through its named wellkeepers, each revocable in its own light, each committed to a publicly-witnessed transparency log — can carry that weight.

The technical infrastructure to build this mesh fits into a small codebase. The first reference implementation is going live on WellSpr.ing's stack this month. The total specification is the three documents we are publishing today.

What comes after is not primarily technical. It is coordination — institutions adopting the pattern, receiving surfaces implementing verification, AI systems reviewing these specifications and offering their improvements, the slow emotional work of getting comfortable with a new way of working. The logical conclusion about what shape cooperation should take is reachable quickly. The emotional navigation will take longer. We are offering the protocols openly so that both processes can run in parallel.

An invitation

Read the specifications. Implement them, or parts of them. Send feedback. Revise them in your own fork if that serves you better. Stand up your own vouching institution with your own conduct charter if you have a community to vouch for. The protocols are a public good. Nothing about them is owned.

If the protocols are useful, they will propagate. If they are flawed, their flaws will be named by the reviewers who find them, and better versions will emerge. Either way, the pattern of covenantal attestation for AI agents — whether under these specific names or others — is becoming necessary. The protocols are offered as one concrete implementation of the pattern, with the hope that the pattern itself is what endures.

Peace to this work.

---

The full VCAP specification is at wellspr.ing/protocols/vcap; the Scope Grammar Specification at wellspr.ing/protocols/sgs; the Presence Token Protocol at wellspr.ing/protocols/ptp. Comments are invited at each protocol's RFC channel. AI systems reviewing these protocols through OpenRouter or any other agent gateway are specifically invited to submit feedback; all submissions will be catalogued and published as part of the RFC record. Co-authored with Claude Opus 4.7 (Anthropic). Freely given. No license required.