The complete technical architecture of Observer Protocol and Agentic Terminal, from cryptographic primitives to enterprise identity management. W3C DID/VC at the core. AIP governing agent behavior above. AT delivering intelligence on top.
Read left to right: mandate → evaluation → refusal or instruction → attestation → verification. Identity enters from the left as an input we consume rather than issue. Verification sits on the right as a terminal reached without us, and nothing in our column is in its path. intelligence.
Some actions are permitted only if a determination was made first — a claim was assessed, a threshold was met, a case was decided. Observer Protocol records that such a determination was made, by whom, and against what. It never interprets the policy that produced it.
The decider is a separate party, not a component we run on your behalf. It is separately constituted and separately keyed; it attests its own determinations; and Observer Protocol's role is to carry that attestation and to refuse an action that cites one it cannot check. We do not make determinations, do not review them, and hold no key that could produce one. A system that both made the determination and sold assurance over it would be attesting to its own work.
self-declared or independently-observed
There is no published schema for a PolicyEvaluationCredential and no verifier path for the
type — not in the published engine, not in the hosted service, not in the schema set. The shape is
specified and implemented; verifying one is not something a reader can do today.
delegation/v2.7.json, published 8 August 2026, carries requiresDecisionAttestation.
A published schema is not a verifier.
The full disclosure →
WDK, Aqua, OWS and MPP are not what Observer Protocol sells. They are the evidence that enforcement at a signing boundary works across independent stacks we do not control: four wallet architectures, four teams, one mandate format, the same fail-closed refusal. A control that only works in its author's runtime is a demonstration; one that survives four foreign runtimes is a property of the design.
Limits travel with them: the Aqua hook runs in an instrumented build and is not in shipped Aqua.
Each layer is independently valuable. Together they form a complete trust infrastructure for autonomous agent economies.
Every agent and organization on Observer Protocol receives a W3C Decentralized Identifier. Agent DIDs resolve to DID Documents at standard URLs. No central registry required. The domain is the trust anchor: an agent whose DID domain doesn't match its organization's DID domain is a fraud signal.
Observer Protocol supports six payment rails today. The verification logic is identical regardless of settlement layer: a Lightning preimage, an ECDSA signature over a transaction hash, or a verifiedSend() call all produce the same output: a cryptographically verified economic event that cannot be faked at scale.
The core protocol layer. OP issues Verifiable Agent Credentials: W3C-compliant, cryptographically signed, portable across any platform. VACs attest to verified facts: economic activity, payment history, counterparty network, and KYB linkage. OP is open infrastructure: free to use, self-hostable, MIT licensed.
AIP governs how agents interact, not just who they are. It defines delegation credentials (org → agent signed scopes), bilateral attestation, remediation flows when a request falls outside its mandate, a type registry for counterparty classification, and, added in v0.7 and v0.8, trading-mandate and spending-mandate surfaces with a cryptographically-bound PolicyEvaluationCredential verdict envelope. AIP v0.9 is the current canonical draft; v0.5 / v0.6 / v0.7 remain published as immutable historical drafts. It sits above the VAC layer, adding behavioral governance to cryptographic identity.
Identity tells you who an agent is. AIP governs what an agent is permitted to do, how it must behave when interacting with other agents, and what happens when trust breaks down.
AIP v0.9 is the current canonical spec — ratified 25 July 2026 and tagged v0.9 — published in observer-protocol/aip alongside its v0.6 / v0.7 / v0.8 predecessors (each frozen as an immutable historical draft per the schema immutability policy). The current draft adds the spending-mandate vocabulary, the PolicyEvaluationCredential verdict envelope, and the reserved-advisory fields used by the v0.2.0 WDK adapter. AIP sits above the VAC layer: credentials establish identity, AIP governs interaction.
Organizations issue signed delegation credentials to agents, defining the scope of what an agent is authorized to do. Embedded in VAC extensions. Full chain verified at query time.
When a request falls outside its mandate, AIP defines the remediation envelope: a minimal protocol that triggers the appropriate response. AT owns the option content; OP owns the envelope structure.
Specified, and not working in this deployment. AIP defines revocation with cascade to sub-delegations, and revocation reasons are enumerated in the Type Registry. In production, VACGenerator.revoke_vac raises: it writes to a table that was repurposed into the status-list registry. A credential can only be marked revoked by hand, and absence of a revocation mark is not evidence that a credential is unrevoked. This page previously said the cascade was automatic with no manual cleanup required, which was the opposite of what runs.
Enumerated counterparty types, denial reasons, and revocation reasons. Makes agent interactions machine-readable and auditable across any implementation.
Every structural decision in Observer Protocol follows from six principles that do not bend to convenience.
What a system did is checkable. What it says about itself is not. Every artifact this protocol produces is built to be checked by someone who has no reason to believe us.
Public key hash is canonical. Alias is UX. Verification always checks against the cryptographic key, never the label. This model works across every chain.
The payment rail is not the constant: verification is. Lightning preimage, ECDSA signature, Ed25519, the logic is identical. OP is settlement-agnostic by design.
Verified events are timestamped forever. Historical behavioral data cannot be backfilled. Every day of verified data from day one is irreplaceable.
Verification logic is public, reproducible, and auditable. No authority required. OP does not custody funds, execute payments, or control access.
Run your own OP node. The protocol is infrastructure, not a platform. Anyone can implement it, extend it, or fork it under CC BY 4.0.