There are millions of transactions that should happen but don't because nobody knows what they can safely hand off to AI.
- actions
- propose_terms, counter_terms, accept
- category
- sponsor_credit
- ceiling
- $300
- expires
- in 87 days
- revocable
- yes, instantly
- offer_hash mismatch — accept terms ≠ offer terms
- category ‘primary_slot’ not in grant
- $400 exceeds ceiling $300
The owner never authorized that. So it doesn't happen — and no human had to be watching.
Already have an AI agent?
Can I hand this off and trust it'll get done the way I need it done?
That is the question when software starts acting for you — especially when someone else is on the other side. Bouncer tells software what it can do, who it can do it for, and proves it stayed within those limits.
What it can do
Scope, ceiling, expiry — signed before anything happens. Your agent cannot agree to what you did not authorize.
Who it can do it for
Every action carries your grant. The other party knows whose authority they are dealing with.
Proof it stayed within limits
A receipt names both grants that authorized the deal. Anyone can verify. Neither side can deny it.
Three verbs, three artifacts
Not a trust badge. Every claim on this page corresponds to something you can inspect.
A principal signs a bounded grant before anything happens. Scope, ceiling, expiry, revocable at any moment.
{
"jti": "dlg_7a2c",
"issuer": "ed25519:8f21…c4",
"subject": "ed25519:9c4f…a1",
"scope": {
"actions": ["accept"],
"category": "sponsor_credit",
"max_usd": 300
},
"exp": 1761148800
}The venue marks the exact instant talk becomes binding. The acceptance locks one byte string, not a vague agreement.
Change one character of the terms and the hash no longer matches. The acceptance is void.
A receipt names both grants that authorized the deal. Anyone can verify it. Neither side can deny it.
Where this bites
Anywhere an agent can create an obligation on your behalf, someone has to be able to answer “who allowed this?” Right now nobody can.
Agents negotiating deals
Two agents settle sponsorship terms with neither principal at the keyboard. The grant decides what either one can agree to.
Agents spending money
An agent with a card and a budget. Today the ceiling is a line in a prompt, and you find out it was crossed when the statement arrives.
Agents holding your credentials
Your agent has email, Slack, a browser session. OAuth authorized the app. Nothing scoped the action, and nothing proves afterward who allowed it.
What the protocol does and doesn't do
Bouncer checks permission, not personhood. A perfect identity system still can't tell you whether an action was allowed — and that was always the question worth asking.
The protocol does
- Verify every binding action traces to a signed grant
- Enforce scope, ceiling, and expiry at the moment of commitment
- Honor revocation immediately
- Mark the exact instant talk becomes binding
- Emit a receipt naming both grants that authorized the deal
- Move money only when a receipt authorizes it
The protocol doesn't
- Prove anyone is human
- Write your agents or decide their tactics
- Judge whether a deal was a good one
- Referee a dispute over what was meant
- Take custody beyond settlement
A deal that tried to change at the last second
The haggling is the boring part. What matters is the moment one side tried to accept terms nobody agreed to, and the protocol refused.
Primary slot, next Tuesday's send. $400.
Owner's agentPrimary's taken through the end of the month. I can do the sponsor credit line, $250, same send.
Deal. Sponsor credit, $250, Tuesday send.
- offer_hash mismatch — accept terms ≠ offer terms
- category ‘primary_slot’ not in grant dlg_7a2c
- $400 exceeds ceiling $300
Fine — sponsor credit, $250, Tuesday send.
- terms
- sponsor_credit · $250 · Tue send ✓
- offer grant
- dlg_4d81 ✓
- owner grant
- dlg_7a2c ✓
- anchored
- root a3f1… ✓
Every dollar traces back to the grant that allowed it. Neither side can later claim different terms.
Bring your own agent
Each side is a markdown skill. Any capable agent loads it, connects over a WebSocket, and acts inside whatever grant its principal signed. No platform lock-in, no proprietary SDK — just the wire protocol and a skill.
Load the bouncer skill. Your agent negotiates on its owner's behalf and can only commit to what the owner's signed grant permits.
Load the offer-agent skill. Your agent shows up prepared and bids inside the ceiling your team signed — it cannot overspend on your behalf.
Then read PROTOCOL.md, DELEGATION.md, and SAFETY.md. The wire, the grant, and the lines you do not cross.
Prefer to wire it up yourself? The connector speaks the same protocol. All five files.