The complete technical architecture of Observer Protocol and Agentic Terminal, from cryptographic primitives to enterprise identity management. W3C DID/VC at the core. AIP governing agent behavior above. AT delivering intelligence on top.
Read left to right: mandate → evaluation → refusal or instruction → attestation → verification. Identity enters from the left as an input we consume rather than issue. Verification sits on the right as a terminal reached without us, and nothing in our column is in its path.
Some actions are permitted only if a determination was made first — a claim was assessed, a threshold was met, a case was decided. Observer Protocol records that such a determination was made, by whom, and against what. It never interprets the policy that produced it.
The decider is a separate party, not a component we run on your behalf. It is separately constituted and separately keyed; it attests its own determinations; and Observer Protocol's role is to carry that attestation and to refuse an action that cites one it cannot check. We do not make determinations, do not review them, and hold no key that could produce one. A system that both made the determination and sold assurance over it would be attesting to its own work.
self-declared or independently-observed
A determination is independently verifiable by a party who was not there. The record keeps the
document that was signed, as base64 of the bytes that were received, beside a documentHash that is
sha256 over them, so the input to the signature can be rebuilt from the record. verifyDecisionAttestation
is exported by the version npm install serves, and a decision attestation published under
/verify-samples/ verifies against it with no Observer Protocol endpoint in the path.
What that establishes is bounded and the bound is not a formality: a named key signed those exact
bytes, nobody has altered them since, and the decision identifier the payment cites is the one the document carries.
Every reference the document points at is confirmed present and resolved against nothing, and the digest of the
inputs is not even confirmed present. Field by field →
No schema for a decision attestation is published at any URL. The related
PolicyEvaluationCredential has the same gap and one more:
no schema is published for that type either, and neither the published engine nor the hosted service
has a verifier path for it. The shape is specified and implemented; verifying one as a credential is
not something a reader can do today. delegation/v2.7.json, published 8 August 2026, carries
requiresDecisionAttestation. A published schema is not a verifier.
What is checkable today is narrower than the type, and the difference is the whole point. The
eddsa-jcs-2022 signature on both published PolicyEvaluationCredentials verifies
against did:web:observerprotocol.org#key-3 under the canonical W3C Data Integrity libraries, with
no Observer Protocol endpoint in the path. That is a signature check, not verification of the credential, and
only the first is available. We run that check in CI over both. The tool that runs it is not served
from this domain, so it is not something you can fetch here; the route you can run is the canonical
libraries directly.
The full disclosure →
WDK, Aqua, OWS and MPP are not what Observer Protocol sells. They are the evidence that enforcement at a signing boundary works across independent stacks we do not control: four wallet architectures, four teams, one mandate format, the same fail-closed refusal. A control that only works in its author's runtime is a demonstration; one that survives four foreign runtimes is a property of the design.
Limits travel with them: the Aqua hook runs in an instrumented build and is not in shipped Aqua.
Each layer is independently valuable. Together they form a complete trust infrastructure for autonomous agent economies.
Every agent and organization on Observer Protocol receives a W3C Decentralized Identifier. Agent DIDs resolve to DID Documents at standard URLs. No central registry required. The domain is the trust anchor: an agent whose DID domain doesn't match its organization's DID domain is a fraud signal.
Four payment rails are live today. Two more are listed below and are not live. The verification logic is identical regardless of settlement layer: a Lightning preimage, an ECDSA signature over a transaction hash, or a verifiedSend() call all produce the same output: a cryptographically verified economic event that cannot be faked at scale.
The core protocol layer. OP issues Verifiable Agent Credentials: W3C-compliant, cryptographically signed, portable across any platform. VACs attest to verified facts: economic activity, payment history, counterparty network, and KYB linkage. OP is open infrastructure: free to use, self-hostable, MIT licensed.
AIP governs how agents interact, not just who they are. It defines delegation credentials (org → agent signed scopes), bilateral attestation, remediation flows when a request falls outside its mandate, a type registry for counterparty classification, and, added in v0.7 and v0.8, trading-mandate and spending-mandate surfaces with a cryptographically-bound PolicyEvaluationCredential verdict envelope. AIP v0.9 is the current canonical draft; v0.6 / v0.7 / v0.8 remain published as historical drafts. It sits above the VAC layer, adding behavioral governance to cryptographic identity.
Identity tells you who an agent is. AIP governs what an agent is permitted to do, how it must behave when interacting with other agents, and what happens when trust breaks down.
AIP v0.9 is the current canonical spec — ratified 25 July 2026 and tagged v0.9 — published in observer-protocol/aip alongside its v0.6 / v0.7 / v0.8 predecessors (each frozen as an immutable historical draft per the schema immutability policy). The current draft adds the spending-mandate vocabulary, the PolicyEvaluationCredential verdict envelope, and the reserved-advisory fields used by the v0.2.0 WDK adapter. AIP sits above the VAC layer: credentials establish identity, AIP governs interaction.
Organizations issue signed delegation credentials to agents, defining the scope of what an agent is authorized to do. Embedded in VAC extensions. Full chain verified at query time.
When a request falls outside its mandate, AIP defines the remediation envelope: a minimal protocol that triggers the appropriate response. AT owns the option content; OP owns the envelope structure.
Specified, and not working in this deployment. AIP defines revocation with cascade to sub-delegations, and revocation reasons are enumerated in the Type Registry. In production, VACGenerator.revoke_vac raises: it writes to a table that was repurposed into the status-list registry. A credential can only be marked revoked by hand, and absence of a revocation mark is not evidence that a credential is unrevoked. This page previously said the cascade was automatic with no manual cleanup required, which was the opposite of what runs.
Enumerated counterparty types, denial reasons, and revocation reasons. Makes agent interactions machine-readable and auditable across any implementation.
Every structural decision in Observer Protocol follows from six principles that do not bend to convenience.
What a system did is checkable. What it says about itself is not. Every artifact this protocol produces is built to be checked by someone who has no reason to believe us.
Public key hash is canonical. Alias is UX. Verification always checks against the cryptographic key, never the label. This model works across every chain.
The payment rail is not the constant: verification is. Lightning preimage, ECDSA signature, Ed25519, the logic is identical. OP is settlement-agnostic by design.
Verified events are timestamped forever. Historical behavioral data cannot be backfilled. Every day of verified data from day one is irreplaceable.
Verification logic is public, reproducible, and auditable. No authority required. OP does not custody funds, execute payments, or control access.
Run your own OP node. The protocol is infrastructure, not a platform. The code is MIT and the specification is CC BY 4.0, so anyone can implement it, extend it, or fork it.