COYL is the authority layer for LLMs acting in the world.

BIP is the consumer-side primitive. Apps emit behavioral signals (a tab-switch, an HRV spike, an open-fridge event). Apps consume a single read API that returns the user’s current behavioral state — archetype, danger-window status, excuse pattern, risk level. No PII. Only behavioral abstractions.

Wearables don’t need to understand psychology. Calendar apps don’t need to model attention. Each emits the signal it already collects; BIP coordinates the meaning. That coordination layer is what every LLM and every device today is missing.

BIP is the substrate both PAP and EAP consume. If you only ship a consumer app, you implement BIP. If you ship an LLM or a device fleet, you read BIP and emit through PAP or EAP.

PAP is how LLMs propose behavioral interventions. A model reads BIP context, decides the moment is right, and submits a Proposal envelope to the COYL Coordinator. The envelope declares the proposed intervention, the rationale, the scope, the channel, and a reversibility class. The Coordinator decides whether to FIRE, DEFER, or REJECT.

PAP exists because behavioral interventions are not free actions. They cost the user’s attention. They can be wrong. They can be overcorrected. The Coordinator enforces rate limits across competing LLMs, dedups proposals targeting the same behavioral moment, checks user scope grants, and respects quiet hours. The user is never spammed by every model on the market firing at the same moment.

PAP is the protocol foundation labs implement to make their assistants behaviorally aware without re-implementing the safety layer. Claude, GPT, and Gemini each emit Proposals. COYL Cloud arbitrates which one — if any — fires.

EAP is the superset. An LLM authors an Action Request — vibrate this Watch, surface this Lock-Screen card, dim this room’s lights, draft this message in the user’s reply queue — and the Coordinator routes it to the right device bridge with the right consent, the right scope, and the right reversibility envelope.

PAP is a subset of EAP focused on behavioral interventions. EAP covers everything else: ambient nudges, calendar actions, browser-context cards, watch glances, surfacing-on-Lock-Screen. The same Coordinator engine governs both. Same audit log. Same revocation surface.

EAP is what makes “your AI” portable across devices without each device fleet needing a direct LLM integration. The LLM speaks EAP. The bridge translates. The user has one consent surface across every model, every device.

UAP is the fourth layer of the COYL stack — the trust contract a user issues to an LLM when they want autonomous action without per-action consent. BIP, PAP, and EAP all assume the user is present: the model proposes, the user confirms, the action fires. UAP is for the moments the user is absent. Daily routines. Tomorrow’s calendar. Recurring purchases. Scheduled deliveries. The category every foundation lab is shipping in 2026, with no defensible consent model under it.

UAP defines exactly eight primitives — GRANT, REVOKE, KILL_SWITCH, PRECHECK, EXECUTE, EXPIRE, RULE_DECLARE, AUDIT_QUERY — and a small set of hard invariants. Every grant has a bounded expiry (90 days max, 7 days default). Irreversibles always re-confirm, even under standing grant. The kill switch supersedes every grant, every rule, every in-flight action, and propagates across all surfaces in five seconds. The audit log is append-only, cryptographically signed, and owned by the user — not the LLM, not COYL.

The strategic read is this: the capability for agentic AI exists today. The trust infrastructure does not. UAP is the layer that lets foundation labs ship agentic AI safely without each inventing a brittle ad-hoc consent model — and the layer that, by virtue of being open-spec, audit-defaulted, kill-switch-first, and cross-LLM portable, cannot be reasonably forked by any single lab without losing the portability that gives it value. The protocol is the trust contract. The trust contract is the moat.