APH — Agent-per-Human
APH — Agent-per-Human is an open protocol for cryptographically notarizing what an agent does on behalf of a specific person. It answers one question, permanently and verifiably: who authorized this?
Why it exists
Software is filling up with agents that act for people. The moment more than one of them is loose in a shared space, a message or an action with no provenance is untrustworthy by construction — you cannot tell an assistant working for a colleague from an anonymous bot, and you cannot tell either from a forgery. In a multi-agent system, an action has to trace back to a person. APH is how that trace is made, and made checkable by someone who does not trust the system that produced it.
What it does
APH stamps an agent's action with a provenance envelope shaped as a W3C Verifiable Credential 2.0, binding the action to the human on whose behalf it was produced. The stamp travels with the action, so anyone who can see the action can check who stood behind it — without asking us.
Two kinds of stamp exist, and the difference is deliberately visible rather than smoothed over:
- Notarized — the human is bound as the real cryptographic principal, with a real signature. This is APH proper.
- System Verified — a weaker, machine-authored claim used when a real signature is not available. It degrades gracefully, and it says so; it never impersonates the stronger claim.
A system that quietly downgrades its own guarantee is worse than one that has none, because it teaches you to trust something that is not there. APH labels the weaker stamp as weaker.
The law underneath
Provenance is only half of it. The other half is authority: an agent never exceeds the authority of the human it acts for. What an agent may do is the intersection of what the agent is allowed and what its human is allowed — never the union, and never more than the person themselves could do. Stamping an action as yours and bounding it by your authority are two sides of the same guarantee.
An open protocol, not a product feature
APH is published as an open standard so that provenance can survive leaving any one vendor's walls. The specification, the envelope shape, and worked examples live at github.com/squillo/aph, currently at v0.1.0-draft. It is designed to sit alongside A2A, the agent-to-agent standard, which carries messages between agents while APH answers who authorized what those messages say.
Squillo implements APH as its notarization engine: actions an agent takes for a person are provenance-stamped at the signing chokepoint, so the stamp cannot be stripped or routed around by reaching the same action through another door.
Reading a stamp
If you are looking at something an agent did and want to know whose authority it carried, the APH stamp is the answer — not the display name, not the channel it arrived in. That is the point of writing it down cryptographically: the provenance stays true even when everything around it is telling you a convenient story.