OPEN TRUST INFRASTRUCTURE

ScopePact

A common trust layer for bounded, accountable agent action across runtimes, protocols, and organizations.

Pre-release alpha Open protocol 8 runtimes under test

Agents propose. ScopePact decides. Tools execute only inside granted scope.

SIGNED DECISION RECEIPT

OUR FOUNDING CONVICTION

Give the agentic world a common language for authority.

As agents move from answering questions to operating tools, services, devices, and money, they cross boundaries built for human accounts and isolated apps. Their authority cannot remain implicit in a prompt or trapped inside one vendor's control plane. ScopePact is our attempt to make delegated authority open, portable, and independently verifiable.

THE AMBITION

Any agent. Any runtime. Any protocol. One accountable answer before consequence: is this action within its mandate?

PROBLEMS WE INTEND TO SOLVE

From local tool calls to cross-organization delegation and payment.

01 · AMBIENT AUTHORITY

Permissions are hidden in prompts and application state.

Make identity, scope, resources, budgets, expiry, and delegation explicit inputs to enforcement instead of assumptions made by a model.

02 · FRAGMENTED TRUST

Authority stops when an agent crosses a system boundary.

Let independent runtimes and organizations exchange a narrow mandate without sharing process state or adopting the same application stack.

03 · UNACCOUNTABLE EFFECTS

A completed action rarely carries proof of why it was allowed.

Produce portable decision receipts so operators can verify the actor, mandate, policy, and exact effect without exposing private model reasoning.

04 · SECURITY SILOS

Every ecosystem should not need to reinvent the same guardrail.

Create an open enforcement contract that can sit beneath MCP, A2A, payment flows, and future protocols instead of replacing their application semantics.

ScopePact exists so more capable agents do not require more ambient trust. Their authority should become narrower, more portable, and more accountable as their reach grows.

DESIGN PRINCIPLE

ONE ENFORCEMENT LAYER

Keep the protocols. Unify the decision.

ScopePact sits at the effect boundary. It does not replace MCP, A2A, payment protocols, or transports; it gives them the same fail-closed authority model.

MCP tools A2A tasks Payment intent

SCOPEPACT KERNEL Identity · scope · limits · replay · policy

ALLOW BLOCK + signed receipt

Identity-bound

Every accepted frame binds sender, audience, session, policy, and payload.

Capability-scoped

Actions, resources, payees, time, calls, and spend remain explicitly bounded.

Effect-safe

Duplicates are suppressed and conflicting effect identifiers fail closed.

Independently verifiable

Domain-separated transcripts produce receipts another runtime can verify.

INSPECT THE EVIDENCE

A protocol decision should explain itself.

The conformance workbench pairs plain-language impact with implementation-level envelopes, payloads, checks, and raw evidence.

ScopePact conformance workbench showing protocol scenarios, verification checks, and signed envelope evidence — Real Python-to-JavaScript conformance evidence. Expected rejection is a passing case.

AVAILABLE NOW

Put a policy gate in front of an MCP server.

ScopePact Guard intercepts tools/call, maps it into the authority kernel, and forwards only effects covered by an installed capability.

Tool: Exact name binding
Resource: Literal or argument prefix
Budget: Calls and cumulative spend
Counterparty: Currency and allowed payees

tools/call /workspace/project/README.md

DECISION ALLOWED

Effect reserved under capability grant.

Rule: project-file-writes
Effect: 105e4fee84141175…
Receipt: Ed25519 verified

EXECUTABLE EVIDENCE

Security claims backed by rejection tests.

15cross-language wire scenarios

37Rust kernel and Guard tests

8runtimes on one transcript vector

1.85verified minimum Rust version

TamperReplayDowngradeDelegation PaymentsPath traversalReceipt integrity

RUNTIME SUPPORT

One transcript. Honest capability levels.

Every listed runtime is checked against the same envelope bytes and Ed25519 signature. Enforcement remains concentrated in Rust while portable SDKs mature.

Runtime Current surface Level

Rust Authority kernel, Guard, receipts, protocol types REFERENCE

Python Envelope signing, verification, negative vectors CONFORMANCE

JavaScript Envelope verification, receipts, browser evidence CONFORMANCE

Flutter Dart transcript and Ed25519 package across Flutter targets ALPHA SDK

Swift CryptoKit transcript and Ed25519 package for Apple platforms ALPHA SDK

Go Standard-library transcript and Ed25519 package ALPHA SDK

C++ C++20 transcript with OpenSSL Ed25519 verification ALPHA SDK

C# / .NET .NET 8 transcript with NSec Ed25519 verification ALPHA SDK

COMMUNITY FIRST

Adoption is the win.

ScopePact is being built as shared trust infrastructure, not a toll on agent communication. Its value grows when independent people can implement it, challenge it, and carry its guarantees into systems we did not design.

View on GitHub Join a discussion

PUBLIC PROJECT COMMITMENT No protocol royalties. No pay-to-play governance. No private conformance standard.

Commercial use is welcome. Money does not buy protocol influence, roadmap priority, a maintainer role, or a favorable verification result.

01 · BUILD

RUN IT LOCALLY

From source to a verified decision.

From a source checkout. No account, hosted control plane, or network token required.

QUICKSTART

cargo test --workspace
./scripts/run-guard.sh
./scripts/run-guard-proxy.sh

Guard profile Protocol boundary Threat coverage Runtime packages

OPEN BY DESIGN

Trust infrastructure should be inspectable.

Apache-2.0 protocol. MPL-2.0 community implementation. Public transcripts, negative vectors, conformance evidence, governance, and security reporting.

Explore the source