AI is moving from answering questions to taking actions. Every agent protocol in production today was designed for the platform, not for you. PAP fixes that — cryptographically. Set the rules. Control the permissions. See everything that happens.
AI agents make hundreds of decisions on your behalf — spending money, choosing vendors, sharing your data — with no control, no visibility, and no receipts.
You searched for a stroller once. Now every website thinks you're pregnant.
For six months. That's one query, with a human behind a browser.
Now imagine AI agents making hundreds of queries on your behalf — every one
leaking context to platforms that build profiles, adjust prices, and sell
your behavioral data to brokers you've never heard of.
None enforce context minimization. None define session ephemerality as a guarantee.
None have economic primitives. Privacy is always somebody else's problem.
PAP makes control, visibility, and safety the protocol's job — not the developer's afterthought. You are the root of trust. Every agent carries a cryptographically verifiable mandate from you.
Every chain of delegation starts with you. Trust flows down through cryptographically signed mandates, each more restrictive than its parent. No agent can exceed the permissions you granted.
PAP uses no novel cryptographic primitives. Every layer is an existing, ratified specification maintained by bodies without platform capture.
| Layer | Standard | Purpose | Body |
|---|---|---|---|
| Identity | WebAuthn | Device-bound keypair generation. Root of trust anchored to hardware. | W3C |
| Identity | W3C DIDs | Decentralized identifiers — did:key. No central registry. |
W3C |
| Credentials | W3C VC 2.0 | Verifiable Credential envelope wrapping mandate payloads. | W3C |
| Disclosure | SD-JWT | Selective claim disclosure. Share 2 of 4 claims. Over-disclosure structurally prevented. | IETF |
| Vocabulary | Schema.org | Capability and action type references. Describes what. Protocol governs under what terms. | schema.org |
| Data | JSON-LD | Structured linked data for agent advertisements. No vocabulary extensions. | W3C |
| Privacy | OHTTP (RFC 9458) | Oblivious HTTP. Cloud request unlinkability. The relay cannot correlate requests. | IETF |
| Transport | HTTP/JSON | 6-phase session handshake: Token → DID Exchange → Disclosure → Execution → Receipt → Close. | IETF |
| Federation | HTTP/JSON | Cross-registry sync, announce, and peer discovery. Content-hash dedup. | — |
did:key derivation, DID documents, ephemeral session keys.pip install pap. Full mandate chain, delegation, and verification from Python.The Rust core is the reference implementation. Language SDKs bring the full protocol surface — keypairs, mandates, delegation, verification — to your stack.
PyO3 bindings expose the entire Rust core to Python. Generate keypairs, issue mandates, delegate to sub-agents, and verify chains — all with native Python types and exceptions.
did:key derivationmaturin develop — Rust 1.75+, Python 3.8+from pap import ( PrincipalKeypair, SessionKeypair, Scope, ScopeAction, DisclosureSet, Mandate, MandateChain, ) # 1. Generate the principal's root keypair principal = PrincipalKeypair.generate() print(principal.did()) # did:key:z6Mk... # 2. Define what the agent is allowed to do scope = Scope([ScopeAction("schema:SearchAction")]) ds = DisclosureSet.empty() # 3. Issue and sign a root mandate mandate = Mandate.issue_root( principal.did(), "did:key:zagent", scope, ds, ttl ) mandate.sign(principal) # 4. Delegate to a sub-agent (scope <= parent) agent_key = SessionKeypair.generate() child = mandate.delegate( agent_key.did(), scope, ds, ttl ) child.sign_with_session_key(agent_key) # 5. Verify the full chain chain = MandateChain(mandate) chain.push(child) chain.verify_chain([principal, agent_key])
| Concern | A2A | MCP | ACP | PAP ✓ |
|---|---|---|---|---|
| Context minimization | ✗ | ✗ | ✗ | ✓ SD-JWT per interaction |
| Session ephemerality | ✗ | Stateful | Optional | ✓ Ephemeral DIDs, keys discarded |
| Field-level disclosure | ✗ | ✗ | ✗ | ✓ SD-JWT selective claims |
| Cryptographic scope enforcement | ✗ | ✗ | ✗ | ✓ Mandate chain verification |
| Agent-to-agent negotiation | ✓ | ✗ (tool access) | ✓ | ✓ |
| Privacy-preserving payment | ✗ | ✗ | ✗ | ✓ Ecash / Lightning proofs |
| Marketplace discovery | Agent Cards | ✗ | HTTP | ✓ Federated, disclosure-filtered |
| Audit trail | ✗ | ✗ | ✗ | ✓ Co-signed receipts |
| Principal control | Platform | User (stated) | Enterprise | ✓ Cryptographic mandate |
# Clone the repository git clone https://github.com/Baur-Software/pap.git cd pap # Run the full test suite cargo test # See protocol demos at # https://baur-software.github.io/pap/papillon/