PAP — the trust infrastructure for proactive AI · COYL

01 · The bottleneck

The bottleneck for proactive AI is not capability. It’s trust.

Anthropic could ship Claude that says “you’ve been on Reddit for ninety minutes; here’s a different thing to do” today. OpenAI could. Gemini could. None of them do it because users haven’t granted that authority, there’s no shared trust infrastructure, the risk of a single bad firing is unbounded, and there’s no standardized consent or rate-limiting or outcome model. The capability has been sitting on the shelf for two years.

PAP is to behavioral intervention what OAuth is to data access, Stripe is to transaction risk, and HTTPS is to transport. The substrate that has to exist before the category can ship. Granular consent scopes per LLM per modality. A shared rate-limit ledger across competing foundation models. A deduplication engine. An audit trail users can read and revoke from.

PAP becomes inevitable because foundation labs can’tship proactive AI without trust infrastructure, and building trust infrastructure is not core to their roadmap. They want to use PAP not because they lack capability, but because they lack speed-to-market on trust. That’s the wedge.

02 · The seven primitives

Seven endpoints. One protocol.

Each primitive is an HTTP-like RPC with a stable schema. The spec is Apache 2.0. The Coordinator engine that evaluates proposals, deduplicates competing LLMs, and fires through the right modality is the proprietary reference implementation.

Primitive 01

Observation API

GET /pap/v1/observation

Returns the user’s current Behavioral Context Object — the read-only abstraction of their behavioral reality. Any LLM with the read_observation scope can call it. This is the substrate every proposal fires against.

http

GET /pap/v1/observation
Authorization: Bearer <pap_oauth_token>

→ 200 OK
{
  "userId": "u_xyz",
  "archetype": "the-9pm-negotiator",
  "state": "high_arousal",
  "selfTrustScore": 73
}

Primitive 02

Proposal API

POST /pap/v1/proposal

LLM emits a proposed intervention with action + context + reasoning. The Coordinator returns allowed, denied, or queued for deduplication. The LLM never fires directly — it earns the right to fire.

http

POST /pap/v1/proposal
{
  "llmId": "anthropic-claude-sonnet-3.7",
  "scopeRequested": ["proactive_food"],
  "action": { "kind": "interrupt", "mode": "high_arousal" }
}

→ { "decision": "allowed", "executionToken": "et_xyz" }

Primitive 03

Execution API

POST /pap/v1/execute

Use the executionToken from the proposal response to fire. PAP picks the modality — Live Activity, Watch haptic, voice, push, browser overlay, Teams message, Slack DM — based on user preference, active surface, and recent firings.

http

POST /pap/v1/execute
{ "executionToken": "et_xyz" }

→ 200 OK
{
  "firedAt": "2026-05-21T21:47:30Z",
  "modality": "ios_live_activity"
}

Primitive 04

Outcome API

POST /pap/v1/outcome

PAP records whether the intervention landed. User-tagged outcomes (caught_me, dismissed, slipped) or inferred outcomes (slip_within_30min). The outcome flows back to the proposing LLM via the subscription webhook.

http

→ POST /pap/v1/outcome   (PAP → itself)
{
  "executionToken": "et_xyz",
  "outcome": "caught_me",
  "outcomeSource": "user_tag"
}

Primitive 05

Subscription API

POST /pap/v1/subscribe

LLMs subscribe to user state transitions or outcome events. PAP fires the webhook when conditions match. This is how proactive AI works without polling — webhook-driven, sub-second, scoped per LLM.

http

POST /pap/v1/subscribe
{
  "subscriptionKind": "state_transition",
  "conditions": {
    "fromState": ["calm"],
    "toState": ["high_arousal"],
    "minConfidence": 0.7
  },
  "webhookUrl": "https://api.anthropic.com/pap/webhooks/state"
}

Primitive 06

Authorization model

OAuth 2.0 · nine scopes

User grants specific LLMs specific authorities via PAP OAuth 2.0 consent flow. Granular, revocable, logged. Per-LLM revoke button + universal panic switch live in the user’s PAP dashboard.

oauth

→ GET /pap/oauth/authorize
   ?client_id=anthropic-claude-sonnet-3.7
   &scope=proactive_food+proactive_focus
   &redirect_uri=https://api.anthropic.com/...

→ user confirms → issued token + audit entry

Primitive 07

Audit + transparency

GET /pap/v1/audit

Every proposal, decision, firing, and outcome is logged in the user’s PAP audit log. Exportable as JSON anytime by the user. Foundation labs cannot delete entries. A "PAP queue" view shows LLMs competing for attention in real time.

http

GET /pap/v1/audit?since=2026-05-01
→ 200 OK
{
  "entries": [
    { "proposalId": "p_abc", "llm": "claude-sonnet-3.7",
      "decision": "allowed", "outcome": "caught_me" },
    { "proposalId": "p_def", "llm": "gpt-5-omni",
      "decision": "denied", "reason": "rate_limited" }
  ]
}

03 · The Behavioral Context Object

The substrate every PAP-integrated LLM reads from.

The BCO is the read-only abstraction of the user’s current behavioral reality — archetype, state, active danger window, signal cluster, commitments, self-trust score, recent interventions, rate limits. No raw PII. Any LLM with the read_observation scope can call it. Authentication via PAP OAuth 2.0 token.

json · GET /pap/v1/observation

{
  "userId": "u_xyz",
  "asOf": "2026-05-21T21:43:12Z",
  "archetype": "the-9pm-negotiator",
  "state": "high_arousal",
  "stateConfidence": 0.84,
  "activeDangerWindow": {
    "label": "Late-night kitchen",
    "startedAt": "2026-05-21T21:00:00Z",
    "endsAt": "2026-05-21T23:00:00Z",
    "confidence": 0.87
  },
  "signalCluster": {
    "hrvDeltaPct": -22,
    "sedentaryMins": 105,
    "locationKind": "kitchen",
    "screenOnMins": 38,
    "weekdayStress": "high"
  },
  "activeCommitments": [
    { "rule": "no food after 9 PM", "kept": 14, "broken": 4 }
  ],
  "selfTrustScore": 73,
  "recentInterventions": [
    {
      "firedAt": "2026-05-20T21:52:00Z",
      "mode": "high_arousal",
      "outcome": "caught_me",
      "source": "anthropic-claude-sonnet-3.7"
    }
  ],
  "quietHoursActive": false,
  "intervention60dRateLimit": {
    "interventionsAllowed": 25,
    "interventionsUsed": 7,
    "remaining": 18,
    "resetAt": "2026-06-20T00:00:00Z"
  },
  "modalityPreference": ["voice", "haptic", "push"],
  "consentedScopes": [
    {
      "scope": "proactive_food",
      "grantedAt": "2026-04-12T18:02:00Z",
      "grantedTo": "anthropic-claude-sonnet-3.7",
      "expiresAt": null
    }
  ]
}

04 · The proposal envelope

LLM proposes. Coordinator decides.

Even if five different LLMs all want to fire in the same window, PAP coordinates — picks the highest-confidence proposal, deduplicates similar headlines, respects rate limits, respects quiet hours, respects the user’s granted scope. The proposing LLM never fires directly. It earns the right to fire.

json · POST /pap/v1/proposal

{
  "proposalId": "p_abc",
  "llmId": "anthropic-claude-sonnet-3.7",
  "userId": "u_xyz",
  "scopeRequested": ["proactive_food"],
  "action": {
    "kind": "interrupt",
    "modality": "voice",
    "mode": "high_arousal",
    "headline": "Stop. Hand on the counter. 4 breaths.",
    "subhead": "9:47 PM. You said no food after 9. Decide at 9:55."
  },
  "context": {
    "trigger": "danger_window_active:late_night_kitchen",
    "confidence": 0.84,
    "reasoning": "HRV dropped 22pts in 90min + sedentary 105min + geofence:kitchen + active commitment:no_food_after_9"
  }
}

→ 200 OK
{
  "decision": "allowed",
  "scheduledFor": "2026-05-21T21:47:30Z",
  "executionToken": "et_xyz"
}

// OR
{
  "decision": "denied",
  "reason": "rate_limited",
  "retryAfter": "2026-05-21T23:00:00Z"
}

// OR
{
  "decision": "queued",
  "reason": "deduplication_pending",
  "competingProposals": ["p_def", "p_ghi"],
  "decisionAt": "2026-05-21T21:47:35Z"
}

05 · Authorization scopes

Nine granular scopes. Per LLM. Revocable.

User grants specific LLMs specific authorities via PAP OAuth 2.0 consent flow. Each scope is granular, revocable, and logged. The user always sees which LLMs hold which scopes, the last thirty interventions per LLM, a per-LLM revoke button, and a universal pause-all-proactive-AI panic switch.

proactive_food
Food + eating interventions. Late-night kitchen, after-meeting graze, weekend bulk shop.
proactive_focus
Work + attention interventions. Tab-switch loops, Reddit/Twitter spirals, deep-work breaks.
proactive_relational
Message-you-shouldn’t-send moments. Heat-of-the-moment drafts, late-night DMs, post-fight texts.
proactive_sleep
Late-night wind-down. Screen time after 11pm, doom-scroll into early hours, blue-light exposure.
proactive_purchase
Impulse buy prevention. Cart-load spikes, late-night Amazon, recurring-rationalization patterns.
proactive_recovery
Post-slip support. The 30 minutes after a broken commitment, when the spiral usually starts.
proactive_substance
Alcohol, nicotine, and similar. Sensitive scope — requires extra user confirmation at grant time.
proactive_mood
Mood-state interventions. Sensitive scope — ships with clinical caveat surface for the user.
read_observation
Read-only access to the Behavioral Context Object. No firing authority. The minimum integration tier.
read_outcome_aggregate
Read aggregate outcome statistics across a user’s interventions. Not per-firing detail.

06 · Pricing

Free to start. Usage scales.

The free tier drives adoption. The usage tier is where revenue compounds. Strategic seats lock in the platform partners with reserved capacity, preferred rates, and co-design influence on the spec.

Free

Free tier

1,000 interventions per month, per user, per LLM. Full Coordinator. Full audit trail. Built for adoption — ship a behaviorally-aware AI feature in a weekend.

No card required

Usage

$0.001 / intervention

Pay-as-you-go after the free tier. No minimums. No tiered lock-ins. Bill per fired intervention, not per BCO read.

Volume discounts at 10M+/month

Strategic

Strategic seat

Reserved

Pharma + Microsoft + Apple + Anthropic + OpenAI + Gemini + foundation labs get reserved capacity, preferred rates, and co-design influence on the spec.

partner@coyl.ai

07 · Get started

Two paths in. Pick yours.

Foundation labs

Strategic seat. Reserved capacity. Co-design.

Anthropic, OpenAI, Google, Apple, Microsoft, and pharma partners get reserved seats with preferred rates and co-design influence on the spec. We ship the Coordinator. You ship the LLM. Users keep the audit trail.

Apply for API key →

App developers

BIP integration first. Then PAP.

BIP v0.1 is the consumer-app-side protocol — the behavioral context layer your app reads and emits. Ship a BIP integration, then upgrade to PAP when you need proactive firing under the trust substrate.

Start with BIP →

08 · FAQ

The five things people ask first.

How is this different from MCP?: MCP connects LLMs to tools and data — read my calendar, search this database, call this API. PAP connects LLMs to behavioral state — propose an intervention because the user is in a high-arousal danger window at 9:47 PM. They complement. PAP uses MCP-style tool calls underneath where it makes sense. The category is different: MCP is about software systems, PAP is about the human behavioral system.
Why won’t Anthropic just build their own?: They could. The barrier is not technical, it’s speed-to-market on trust — a shared consent ledger across competing LLMs, a deduplication engine, a user-controlled audit trail, granular per-LLM scope tokens. Building those is real engineering plus real product plus regulatory thinking. Most foundation labs prefer to adopt an open protocol than to build their own trust substrate. Same playbook as MCP.
Can users revoke an LLM’s authority?: Yes. Per-scope, per-LLM, anytime, with a universal pause-all switch. Revocations are logged — the historical interventions an LLM fired before revocation stay in the audit log (anonymized to the model family, not tied to an individual API key). Revocation is instant. The next proposal from that LLM is denied with reason scope_revoked.
How are rate limits enforced across competing LLMs?: The Coordinator maintains a per-user 60-day intervention budget (default 25, user-adjustable). All competing LLM proposals draw against the same budget. When five proposals land in the same danger window, the Coordinator picks the highest-confidence one, deduplicates similar headlines, and denies the rest with rate_limited or deduplication_pending. LLMs see the response and update their per-user proposal-quality model.
What’s the latency for proposal evaluation?: P50 is under 80ms, P99 under 240ms in the reference Coordinator. The state classifier runs ahead of proposal time — by the moment a proposal arrives, the user’s current BCO is already cached. Proposal evaluation is rate-limit check, dedup check, quiet-hours check, confidence-threshold gate. Firing latency is modality-dependent: Live Activity is under one second, push under five, email under sixty.

09 · The sibling protocol

PAP is the trust infrastructure for proactive AI. EAP is the same substrate, turned inward — the protocol an agent uses to be honest with itself.

Both Apache 2.0. Both reference-implemented by COYL Cloud. Both built on the same belief: AI for the moment before behavior happens, not the moment after.

Read the PAP spec on GitHub →The EAP companion →The full protocol stack Read the manifesto

COYL · Catch yourself before you do it again.