The competing bet.

The tenant model is not the competitor; it wins its own ground and should. The competitor is federation, in two forms — the network that clears payments between strangers, and the vertical system of record that holds each organization’s slice of a person — and the bet is about the domains where neither can be the root. Which domains those are, in what order, and what would have to be true for each is a strategy rather than a principle, and it has its own page.

1. 01

   Every concern has a private dimension and a public projection; the chain enforces value and projects claims.

   A principal’s account is counterfactual: its address is computable from its custody configuration — a passkey, a social recovery set, a hardware key — and its signatures verify before it is ever deployed (ERC-6492). Identity, delegation and relationship are therefore defined, signed and verified off chain against that address, with no chain footprint. The chain enters for two reasons and on two ledgers: a private estate chain, validated by the domain’s own institutions, enforces value at commit and holds the private graph without exposure; a public chain carries the public projection — anchored receipts, admissions, reviews, provenance commitments, and set roots against which a stranger can verify membership or non-revocation without learning the graph.

   Consequence. For every other effect — a message, a vault write, a call to a provider — the chain is the ordering and revocation oracle, and the enforcement is the harness at one end and the resource owner’s admission at the other. There is a seam at every effect the chain does not order; the receipt names which end committed it. Neutral means the private chain is a consortium and the public projection is on ground nobody in the domain operates.

2. 02

   The identity can sign; the behaviour is a separate claim.

   Every principal — person, organization, service — is a smart account (ERC-4337): it verifies signatures about itself (ERC-1271), issues and revokes grants, holds value, executes logic, recovers by quorum. A name, a DID document, an NFT id, a SPIFFE id, a registry entry is a projection the anchor signs and can discard.

   Consequence. A principal keeps its address while its model, operator and playbook change. Every receipt cites the behaviour definition’s digest, and trust edges are keyed on principal and behaviour together. The cost — every principal needs an account, a custody policy and a paymaster — is paid for portability the person may never use, and is stated rather than hidden.

3. 03

   Rotation preserves grants because the Home re-approves them; recovery revokes their descendants. Neither changes the identity.

   Passkeys, hardware keys and KMS session keys are facets beneath the account under a custody policy. The contract’s invariant is strict and right: retiring any credential bumps the custody epoch, and every grant signed by that credential or approved under that epoch dies at redemption. Rotation — add a credential you control, retire one you still control — is therefore a ceremony that re-approves every standing wire under the new epoch in the same batch, so that from a counterparty’s vantage point nothing happened. Recovery — a credential you no longer control — bumps the epoch and re-approves nothing; every descendant of the compromised epoch is dead, and the person re-issues from a reviewed list.

   Consequence. Moving between Homes is a rotation, never a recovery. A leaked key is a recovery; the anchor, its names and its history are untouched. No application is a custodian: a service that acts as an agent holds a narrow delegation to its session key, never the identity’s key.

4. 04

   A token is a claim that authority existed at issue time. A delegation is the authority itself, still checkable at act time.

   Authority is a signed, caveated, attenuable, revocable artifact (ERC-7710) issued by the principal — no central authorization server. Caveats are executable: this payee, this ceiling, before this time, once. A delegate can only narrow. What federation cannot give is the first and last of these: principal-issued, and enforced at commit by code no party to the act operates.

   Consequence. A principal can delegate only what it has. Every resource owner remains the verifier of the grants it chooses to recognize; there are as many verifiers as resources, and the substrate is strongest where the resource is the principal’s own — its treasury, its vault, its agent.

5. 05

   Consequential effects bind to one typed intent; open intents decompose.

   A mandate is a delegation plus two caveats: the digest of one typed intent — payee, resource, amount, outcome — and a single-use nonce derived from a logical request identity. For payments the enforcer pins payee and ceiling. Confirmation is a passkey signature over that digest, and the act cannot commit without it. An open intent — “organize the retreat for under two thousand” — is a caveated delegation that bounds the envelope; each consequential effect inside it becomes its own closed mandate as it becomes concrete, and a conformance check compares each proposed effect against the stated outcome before it is offered for signature.

   Consequence. The planner may be creative about how; it cannot change what. AP2’s intent and cart mandates are the same split; the substrate adds enforcement at commit and the owner’s receipt.

6. 06

   Verification lives outside the model, at every step, and at the end that commits — with a defined clock.

   The grant is checked before each step and re-checked after every human approval. Then it depends on who orders the effect. Chain-ordered effects — value — are enforced by the mandate’s caveats inside the transaction that commits. Estate-ordered effects — a vault write, a message, another agent on the estate — are verified again by the receiver at the moment it executes, so there are two independent checks and the receiver’s is the one that counts. Externally ordered effects — a provider’s API — are verified once, and the receipt names the adapter that committed and what it observed; irreversible ones require a fresh signature. A revocation counts from inclusion on a chain with immediate finality and from finality elsewhere. An executor that cannot reach the chain stops. Aggregate limits are enforced at the resource, not the grant.

   Consequence. No protected act ever runs on a stored verdict. Revocation latency is a property of the network; never acting stale is a property of the design. There is a window between verification and an external provider’s commit; it is declared per tool, not denied.

7. 07

   Accountability has three shapes, by doctrine.

   PROV-O’s Person, Organization and SoftwareAgent, taken as the substrate’s convention: a team is an organization; a treasury is a service chartered under the organization whose money it holds; a steward authorizes and the treasury transacts under a mandate. For a person, the treasury is a facet of their own account with the same enforcers unless a reason requires otherwise.

   Consequence. charteredUnder, memberOf and stewardOf are never sufficient for permission. A policy may require current membership as one explicit condition; a verifier may never infer permission from a relationship.

8. 08

   One layered vocabulary from utterance to audit; behaviour generated, authority never; versions bound.

   Intent, capability, relationship, receipt, plan step and trust edge are IRIs in one layered ontology: open upper standards above, the Agentic Trust vocabulary beneath, the substrate’s modules bound to code, a domain beneath that, and a solution’s own extension at the edge. Code binds by IRI and a build gate fails on an invented term. Skills define an action once; the interface, the planner’s tools and the card are generated from it. Memory, knowledge, coordination and provenance are typed against the same stack, and standards the world already speaks — PROV, W3C Organization, ActivityStreams, A2A, ERC-8004, ValueFlows, schema.org — are reached through crosswalks, not rewrites. A mandate binds the schema and execution-semantics version it was approved under.

   Consequence. A playbook says how; it grants nothing. Four generated surfaces can agree about the wrong behaviour, so live gates with negative twins validate behaviour independently of the definition that generated it. Two organizations that mean different things by “member” resolve it once, at the domain layer, with both meanings named — never silently at the moment of an act.

9. 09

   Records belong to the owner; each principal holds its side; the app is a cache.

   The test for any store: wiped, is it a rebuild or a bereavement? Bereavements live in the owner’s vault, ontology-shaped, per-record scoped, portable to another Home. An organization is a principal with a vault; a shared record has a side in each signer’s vault; a departing member keeps their receipts and not the organization’s records. A relationship has three forms: a vault credential each party holds and presents under grant; a record on the private estate chain where enforcement needs it; and, on the public chain, only a commitment — a set root or a membership proof — never the edge.

   Consequence. Two knowledge tiers never meet inside an engine: a public graph that holds only what any chain read reproduces, and a private vault read by selector under the asker’s grant. A generated query is never the reason something is disclosed, and a public chain read never reveals who belongs to what.

10. 10

    Evidence travels with the owner, and its completeness is anchored.

    Every protected act leaves a PROV receipt — tool, risk, mandate, verifier decision, approver signature, transaction hash, playbook digest — in the owner’s vault, recomputable without the runtime’s cooperation. Each receipt says which of four things it attests: attempted, accepted, state changed, outcome occurred. A run’s bundle digest is anchored on chain, so a verifier has an authoritative head and withholding is visible.

    Consequence. The runtime’s trace is the vendor’s; the receipt is the person’s. The behaviour definition is attested for identity; environment attestation is admitted as one more evidence edge, and the reader appraises.

11. 11

    Trust is a graph; no score at the index; the reader computes.

    No ranked list at the index beyond relevance, no index above the registries, no registry that can revoke a grant it never issued. Signed edges — member-of, attestation, verification receipt, interaction receipt, admission — are returned separately. A relying party may score, rank and shortlist from them; that is the principle, not an exception to it. Edges count against collusion only where they cost something — a payment that happened, an admission with a real bar, an attestation from a party with standing.

    Consequence. Resolution returns addresses, never credentials. Be what registries are built from. Canonical identities establish continuity, not independence; the graph is Sybil-resistant only through costly edges.

Where we hold the line, and where we do not. Shared meaning for what an agent may do — intent, capability, mandate, receipt — is settled in the stack and never translated at the moment of an act. Shared meaning for data an application merely reads may well be translated by a model at the edge, and the crosswalks are where that happens. The counter-hypothesis — that cheap translation makes a shared ontology unnecessary — is answered by that line, and it is testable: two independent teams integrate a new domain against the stack and against a schema-and-adapter baseline, and the stack has to win on time to the first working mandate and on semantic defects the gates catch.

The full composition matrix →