01 · What this is, in plain English
An agent that can act needs a contract for how far it can go.
Connecting a model to tools is the easy part — that’s what MCP already does. The hard part is everything that has to be true before you let that model act on a real person’s behalf when they aren’t watching: a grant that says exactly what’s permitted, a hard expiry, a way to refuse the irreversible, a tamper-evident record of what happened, and a single switch that takes all of it back in seconds.
COYL is that layer. The person grants bounded authority. The agent acts only inside it. Every action is checked against scope, rate limits, quiet hours, and a safety floor before it fires — and every representation action is signed so the recipient can verify who acted and under whose authority. One consent surface across every model; one kill switch across every device.
It works the same way whether the “agent” is a foundation-model assistant acting overnight or COYL’s own consumer app at coyl.ai nudging someone at the right moment. The authority layer doesn’t care who’s acting. It cares whether the person said yes, and whether the action is still inside what they said yes to.
02 · The stack — implemented, not aspirational
Five layers. One safety floor under all of them.
Each layer answers one question, in plain English, and each is implemented in this repository today — read, propose, act, hold standing authority, and stop. The acronyms are a reference detail; the value is the column on the right.
Read · what loop is the person in?
Behavioral context.
A read API that returns the person’s current behavioral state — abstractions only, no raw personal data. Apps emit the signals they already collect; this layer coordinates the meaning so the others have ground truth to act on.
BIP — Behavioral Interrupt Protocol
Propose · should the AI act right now?
Proposal coordinator.
An LLM proposes an action; the coordinator decides FIRE, DEFER, or REJECT against scope, rate limits, dedup, and quiet hours. If two models target the same moment, only one fires. The person is never spammed by every model at once.
PAP — Proactive-Action Protocol
Act · how does the action reach the person?
Cross-device execution.
One action at a time across watch, phone, browser, and ambient surfaces, each carrying a reversibility class. Irreversible actions never auto-fire — they route to a per-action confirmation. One consent surface across every device.
EAP — Execution-Action Protocol
Authority · what may it do while you’re away?
Standing authority.
A bounded grant for the moments the person is absent — scope-limited, time-limited (hard expiry), rule-governed, audit-signed. The kill switch revokes every grant. Irreversibles always re-confirm, even under a standing grant.
UAP — User-Authority Protocol
Stop · when does it route to a human?
Safety floor.
When risk crosses the floor, the coaching path closes and routes to a human — overriding every other layer. This runs first, on both the agent path and the consumer interrupt path. Implemented in this repo today.
RAP — Risk Assessment Protocol
03 · The safety floor is live
The first thing a Trust & Safety reviewer asks. We answer it in code.
Before anyone certifies an AI that acts in a person’s life, they ask one question: when does the AI stop coaching and route the person to a human? COYL’s safety floor is the answer, and it’s not a promise on a slide — it’s a gate that runs first, ahead of every other check.
One floor, both paths
When risk crosses the floor, the coaching path closes — and nothing fires until a human reopens it.
The same closed-path check gates both sides of the system. On the agent side, it’s the very first gate in the proposal coordinator and in standing- authority execution — a crisis-class assessment denies the action outright, ahead of scope, rate limits, and quiet hours. On the consumer side, the same check runs before any interrupt is sent: a person in a closed coaching path is never nudged. The classifier, the routing envelopes, and the closed-path store are implemented in this repo today.
04 · The proof you can run
A typed SDK and a runnable demo. Both alpha. Both real.
The fastest way to evaluate an authority layer is to grant authority and try to break it. So we made that the demo.
The SDK
@coyl/protocol — typed, alpha, zero-dependency.
A TypeScript SDK with two clients: UAPClient for standing-authority grants (grant / precheck / execute / revoke / audit / kill-switch / verify-provenance) and EAPDeviceClient for the device side (register, poll for approved actions, report outcomes, publish sensor snapshots). Typed against the live route handlers, not the spec prose. Alpha — wire shapes may change before 1.0.
The demo
A standing grant you can try to break.
A runnable script issues a scoped, expiring grant, then walks the full trust contract against a coordinator: a reversible action is allowed and audited, an irreversible send is denied, provenance on an allowed representation action is verified, and the kill switch ends all authority — after which the next action is dead.
The authority demo, in five steps
- ·GRANT — issue a scoped, expiring, rule-bounded standing grant.
- ·EXECUTE a reversible action — allowed, and written to the audit log.
- ·EXECUTE an irreversible send — denied; it fails closed and demands per-action confirmation.
- ·PROVENANCE — verify the cryptographic signature on an allowed representation action.
- ·KILL_SWITCH — kill all authority, then prove the next action is denied.
The denial of the irreversible send is the whole point: a standing grant does not let an agent do something it can’t take back. It fails closed.
05 · Who this is for, and where it stands
Built for foundation labs and the teams shipping agents that act.
If you own an AI platform, you’re going to ship agents that act on people’s behalf — and you’ll need a defensible answer for permission, audit, control, and provenance. We’d rather build that answer with a few design partners than hand you a finished black box.
The buyer
Head of AI Platform · CTO · CISO · AI governance.
The person who has to certify that an agent acting on a user’s behalf is scoped, audited, and kill-switchable — and who would rather adopt a neutral layer than reinvent one per product.
The specs
Published. Apache 2.0.
The five specs are open and free to implement. The category only exists if the contract is open; we win on the engine and the integration depth, not on a closed document.
The engine
Reference engine + SDK in alpha.
The coordinators, the safety floor, the typed @coyl/protocol client, and the runnable demo are in this repo. Wire shapes can still change before 1.0 — which is exactly why we’re inviting design partners now.
Become a design partner.
If your team is shipping agents that act on a person’s behalf, we want to build the authority layer with you. Read the stack, run the demo, then start a conversation. One inbox, one human on the other end.
07 · The line
The authority layer for LLMs acting in the world.
Tools without permission is a liability. COYL is the permission, audit, control, and provenance an agent needs before it acts on someone’s behalf.