Every agent protocol in production today was designed to serve platform operators, not human principals. PAP fixes the root cause — cryptographically.
AI agents make hundreds of queries on your behalf — each one leaking context to platforms that build profiles, adjust prices, and sell your behavioral data to brokers you've never heard of.
You searched for a stroller once. Now every website thinks you're pregnant.
For six months. That's one query, with a human behind a browser.
Now imagine AI agents making hundreds of queries on your behalf — every one
leaking context to platforms that build profiles, adjust prices, and sell
your behavioral data to brokers you've never heard of.
None enforce context minimization. None define session ephemerality as a guarantee.
None have economic primitives. Privacy is always somebody else's problem.
PAP makes privacy the protocol's problem — not the developer's. The human principal is the root of trust. Every agent carries a cryptographically verifiable mandate from that root.
PAP uses no novel cryptographic primitives. Every layer is an existing, ratified specification maintained by bodies without platform capture.
| Layer | Standard | Purpose | Body |
|---|---|---|---|
| Identity | WebAuthn | Device-bound keypair generation. Root of trust anchored to hardware. | W3C |
| Identity | W3C DIDs | Decentralized identifiers — did:key. No central registry. |
W3C |
| Credentials | W3C VC 2.0 | Verifiable Credential envelope wrapping mandate payloads. | W3C |
| Disclosure | SD-JWT | Selective claim disclosure. Share 2 of 4 claims. Over-disclosure structurally prevented. | IETF |
| Vocabulary | Schema.org | Capability and action type references. Describes what. Protocol governs under what terms. | schema.org |
| Data | JSON-LD | Structured linked data for agent advertisements. No vocabulary extensions. | W3C |
| Privacy | OHTTP (RFC 9458) | Oblivious HTTP. Cloud request unlinkability. The relay cannot correlate requests. | IETF |
| Transport | HTTP/JSON | 6-phase session handshake: Token → DID Exchange → Disclosure → Execution → Receipt → Close. | IETF |
| Federation | HTTP/JSON | Cross-registry sync, announce, and peer discovery. Content-hash dedup. | — |
did:key derivation, DID documents, ephemeral session keys.pip install pap. Full mandate chain, delegation, and verification from Python.PyO3 bindings expose the entire Rust core to Python. Generate keypairs, issue mandates, delegate to sub-agents, and verify chains — all with native Python types and exceptions.
did:key derivationmaturin develop — Rust 1.75+, Python 3.8+from pap import ( PrincipalKeypair, SessionKeypair, Scope, ScopeAction, DisclosureSet, Mandate, MandateChain, ) # 1. Generate the principal's root keypair principal = PrincipalKeypair.generate() print(principal.did()) # did:key:z6Mk... # 2. Define what the agent is allowed to do scope = Scope([ScopeAction("schema:SearchAction")]) ds = DisclosureSet.empty() # 3. Issue and sign a root mandate mandate = Mandate.issue_root( principal.did(), "did:key:zagent", scope, ds, ttl ) mandate.sign(principal) # 4. Delegate to a sub-agent (scope <= parent) agent_key = SessionKeypair.generate() child = mandate.delegate( agent_key.did(), scope, ds, ttl ) child.sign_with_session_key(agent_key) # 5. Verify the full chain chain = MandateChain(mandate) chain.push(child) chain.verify_chain([principal, agent_key])
Each example exercises protocol features the others do not. Proving the trust model works in code, not prose.
| Concern | A2A | MCP | ACP | PAP ✓ |
|---|---|---|---|---|
| Context minimization | ✗ | ✗ | ✗ | ✓ SD-JWT per interaction |
| Session ephemerality | ✗ | Stateful | Optional | ✓ Ephemeral DIDs, keys discarded |
| Field-level disclosure | ✗ | ✗ | ✗ | ✓ SD-JWT selective claims |
| Cryptographic scope enforcement | ✗ | ✗ | ✗ | ✓ Mandate chain verification |
| Agent-to-agent negotiation | ✓ | ✗ (tool access) | ✓ | ✓ |
| Privacy-preserving payment | ✗ | ✗ | ✗ | ✓ Ecash / Lightning proofs |
| Marketplace discovery | Agent Cards | ✗ | HTTP | ✓ Federated, disclosure-filtered |
| Audit trail | ✗ | ✗ | ✗ | ✓ Co-signed receipts |
| Principal control | Platform | User (stated) | Enterprise | ✓ Cryptographic mandate |
search for the simplest full handshake, or jump to delegation-chain for the trust hierarchy in action.localhost:9090.# Clone the repository git clone https://github.com/Baur-Software/pap.git cd pap # Run the full test suite cargo test # Core protocol examples cargo run --bin search # Zero-disclosure search cargo run --bin travel-booking # SD-JWT selective disclosure cargo run --bin delegation-chain # 4-level trust hierarchy cargo run --bin payment # Ecash + auto-approval # Transport & federation cargo run --bin networked-search # 6-phase HTTP handshake cargo run --bin federated-discovery # Cross-registry federation cargo run --bin webauthn-ceremony # Device-bound keys # Local AI assistant (Docker) cd examples/local-ai-assistant docker compose up -d docker exec ollama ollama pull mistral # Ask a question — your prompt stays local curl http://localhost:9010/ask \ -d '{"query":"What is the weather in Seattle?"}' # See exactly what was disclosed curl http://localhost:9090/receipts