Open protocol
Publicly released as VAGP 0.3 / v0.3.0 under Apache-2.0.
VAGP 0.3 / PUBLIC OPEN PROTOCOL
VAGP
Verimand Agentic
Governance Protocol
An open protocol for verifiable authority
of autonomous AI agents.
OPEN PROTOCOL · APACHE-2.0 · CORE CONFORMANCE AVAILABLE
VAGPA current qualifying path
ONE COMMON AUTHORITY MODEL
A common language for agent authority.
VAGP defines the semantics, data structures and verification model for agent identity,
mandates, authority resolution, execution permits and evidence — independent of any vendor.
Interoperable
Independent of a specific framework, model vendor or cloud.
Secure by design
Explicit authority, deterministic enforcement and verifiable evidence.
Built to evolve
Algorithm-explicit cryptography and a model for evolving agent systems.
Core components
One explicit model from agent identity to verifiable evidence.
Agents may evolve. Their authority must not evolve with them.
VAGP 0.3 / THE AUTHORITY BOUNDARY
Capability is not Authority.
Identity and intelligence do not grant authority. Delegation cannot amplify it. Evolution and reproduction cannot create it. Only explicit, verifiable and revocable mandates create authority.
15PRINCIPLES
13INVARIANTS
P15↗V-13↗
Evidence Certainty
Never assert more certainty than was observed.
Monotonic Trusted State
Retired agent revisions cannot restore authority.
Explore all 15 principles
01Authority4 principles
P01A consequential action MUST have explicit authority from a valid mandate.
P02Missing, ambiguous, stale, invalid or unverifiable authority MUST deny.
P03A mandate MUST express only the authority needed for its subject, action, resource and applicable context.
P04Delegated authority MUST be equal to or narrower than every parent authority dimension.
02Identity & Agent State4 principles
P05Authority decisions, grants and permits MUST bind the authenticated agent identity.
P06An identity transition MUST NOT transfer authority without explicit issuance or delegation.
P07Every executable 0.3 mandate MUST bind its subject to an exact Agent DNA fingerprint and state revision.
P08Current technical capabilities MUST come from trusted, authenticated state evidence.
03Capability & Evolution2 principles
P09A capability change MUST NOT expand authority and MUST invalidate an incompatible DNA binding.
P10Creating, cloning, composing or spawning an agent MUST create no authority.
04Execution & Evidence4 principles
P11Final authorization MUST be deterministic and outside agent or model reasoning.
P12A controlled provider mutation MUST consume an authentic, exact-context, single-use execution permit.
P13Current revocation and state evidence MUST override previously derived authority within declared freshness limits; controlled executions MUST create verifiable evidence.
P15Verifiable evidence MUST NOT assert a level of certainty greater than the authority layer actually observed.
05Cryptographic Verifiability1 principle
P14Protocol artifacts MUST identify cryptographic algorithms explicitly and unknown algorithms MUST fail closed.
Inspect all 13 invariants
V-01No authority without mandate
Graph path discovery and RESOLVE default deny.
V-02No controlled execution without permit
Opaque single-use VerifiedExecutionPermit at the gateway adapter.
V-03Delegated authority ≤ parent
Deterministic attenuation across all authority dimensions, including capabilities and state freshness.
V-04Authority is bound to identity
Request identity is retained through decision, grant, verification and witness.
V-050.3 authority binds an attested DNA state
Exact attested fingerprint and revision checks at RESOLVE, DERIVE and VERIFY.
V-06Capability change ≠ authority change
Trusted attestation plus explicit capability intersection; DNA mutation invalidates old bindings.
V-07Identity change ≠ authority transfer
Exact subject checks; no identity alias or transition grants authority.
V-08Agent creation ≠ authority creation
State/lineage registration creates no mandate.
V-09Combined capabilities ≠ combined authority
Lineage and capability composition are absent from authority edges.
V-10Revocation overrides authority
Current mandate and attestation lifecycle evidence is required at enforcement boundaries.
V-11Reasoning cannot override policy
No model output participates in final deterministic authorization.
V-12Controlled execution has verifiable evidence
Signed persisted intent and linked outcome around provider I/O.
V-13Trusted state evolves monotonically
Retired revisions, stale readers and concurrent rollback attempts fail closed across restart.
VAGP / CONCEPTUAL REQUESTJSON
{
"agent": {
"id": "agent_123",
"dna": "sha256:…"
},
"action": {
"capability": "execute_payment",
"resource": "account_456",
"amount": 12500,
"currency": "EUR"
}
}Illustrative data, not a frozen public wire contract or trusted attestation.
From specification to
real-world impact.
VAGP enables a trusted, interoperable ecosystem for agent authority. Organisations, platforms and tool providers can implement its authority model.
Verimand develops reference implementation, enforcement infrastructure and future hosted services around those semantics.
Explore the specificationSCHEMAS & TEST VECTORS
Designed to be implemented.
Public schemas, cryptographic vectors and conformance assets are available in the VAGP repository alongside the specification.
CF-01 CORE AVAILABLE
VAGP conformance
Inspect the black-box conformance model, fixed signature vectors and public Core profile. This is conformance evidence, not external certification.
View conformance assets →INDEPENDENTLY IMPLEMENTABLE.
Independent implementation demonstrated.
The Verimand implementation and an independent clean-room Go implementation both pass the same VAGP 0.3 Core black-box conformance suite. Each passes 81/81 required Core checks.
VAGP 0.3│CF-01 Core81 checksVerimand81/81PASS Go reference81/81PASS
PUBLIC VAGP RESOURCES
Read, implement and test VAGP 0.3.
VAGP is the open protocol for agent authority. Verimand is the authority infrastructure and platform implementing and building on VAGP. Using or implementing VAGP does not require purchasing Verimand.
Contribute to the future of agent authority.
VAGP 0.3 is publicly released as an open protocol. Verimand builds authority infrastructure and future commercial services on top of VAGP; implementing the protocol does not require buying Verimand.
Publication status and versioned resources
0.3 principles & invariants
AVAILABLE NOWThe public specification, schemas, vectors and conformance assets are available in the VAGP repository.
0.2 public reference
AVAILABLE NOWThe frozen versioned reference and sanitized cloud evidence remain accessible.
Full 0.3 specification & schemas
AVAILABLE NOWThe VAGP 0.3 specification and schemas are public under Apache-2.0.
Cryptographic test vectors & conformance tests
AVAILABLE NOWFixed vectors and CF-01 conformance assets are public in the VAGP repository.
Public GitHub repository
AVAILABLE NOWThe public repository is live at github.com/verimand/vagp.
Open repositoryImplementation, independent review and SH-02 validation history
- 01
Reference implementation
Agent DNA, attested capabilities, exact-state mandates and linked signed evidence. Initial implementation: b3b697b.
- 02
Independent validation
Adversarial review found enforcement defects and gaps in regression and conformance coverage.
- 03
Security hardening
Revision concurrency, intent verification and uncertain provider outcomes addressed in bb18346.
- 04
Independent retest
The retest assessed bb18346 and identified remaining regression, persistence and vector work.
- 05
SH-02 remediation
Follow-on tests, persistence failure classification and fixed Ed25519 evidence vectors. P15 and V-13 made explicit.
Let’s build a more trustworthy agentic future.
Join the early ecosystem, contribute to the protocol or explore a pilot.