See what your agents can cause. Route them safely. Prove what happened.
Open-source trust and execution infrastructure for AI agents.
Try it in 60 seconds · PCTR · Examples · Protocol spec · Contribute
Your agent can have valid credentials and still be about to do the wrong thing.
Objective -> Trust Route -> Consequence Preview -> Execution Authority -> Protected Action -> Receipt
PCTR — Protected Consequence Trust Routing — maps every agent, tool and action in your project to the consequences it can reach, then protects the ones that matter. It answers three questions, in this order:
| Question | Command | |
|---|---|---|
| 1. Consequence | What can this action cause? | pctr preview <action> |
| 2. Route | Which trustworthy agent path may get there? | pctr route <action> |
| 3. Authority | Is this exact execution allowed right now? | pctr protect <action> |
npx @blocksifr/pctr init # discover agents and tools, write pctr.json
npx @blocksifr/pctr scan # what consequences can they reach?No agents in the project? init says so rather than inventing any; --example writes a
worked example that every view labels as made-up.
pctr scan --share turns that into Markdown you can paste into a pull request, and
packages/pctr/examples/pctr-scan.yml runs it on every PR as a comment.
No account, no network: everything stays in ./pctr.json and ./.pctr. Three flagship capabilities sit on top of that graph — the Consequence Twin (pctr preview), TrustRoute Autopilot (pctr route), and the Agent Time Machine (pctr replay, pctr explain) — with Ed25519-signed receipts, read-only probes that measure a consequence instead of declaring it, adapters for the common agent frameworks, and an effect boundary (pctr serve) that verifies authority in its own process. See the PCTR README, npm run demo:pctr and npm run demo:pctr-fabric.
PCTR routes to the consequence. TTP binds the authority for the exact execution that reaches it.
Your AI has credentials. BlockSiFr gives it boundaries.
Same identity. Same permission. Different consequence. Different decision.
BlockSiFr Control is the commercial product for production enforcement, in the Execution Control Infrastructure category, powered by Consequence Intelligence. TTP and PCTR are the open protocol layer beneath it, Apache-2.0, and stay that way — see NOTICE for the royalty-free grant.
Public launch: January 6, 2027. Early access is open now for organizations, builders, design partners and strategic partners: hello@blocksifr.com.
Put an action under Control.
TTP is the open protocol for machine chain trust: proving whether the chain behind an AI agent, copilot, workflow, pipeline, API, service account, or non-human identity is trustworthy enough to be relied on, before downstream authority and execution decisions occur.
Identity proves who is acting. Authorization defines what was assigned. TTP establishes whether the chain behind this action deserves reliance, right now — before any downstream authority or execution decision is made.
An isnad is a chain of transmission: who received what from whom, and whether each link is sound. An autonomous action has the same shape — a model acted on a prompt, handed to a tool, through a workflow, carrying authority delegated by a person no longer in the room. TTP evaluates that chain, and grades it rather than returning a boolean. See Chain Trust Model.
| Layer | Responsibility |
|---|---|
| TTP | Machine isnad / chain trust |
| SCIM-RE | Runtime identity and authority schema |
| RAP | Authority decision engine |
| Execution Exchange | Downstream enforcement / control plane |
| CortexTrace | Evidence and trace capture |
| ExecutionReceipts | Cryptographic proof objects |
TTP establishes whether a chain deserves reliance. Downstream authority systems decide whether execution may proceed.
OAuth standardized delegated access. SCIM standardized identity provisioning. TTP standardizes trust-before-execution for autonomous systems. It is a platform-agnostic trust protocol — bring any agent, IdP, gateway, or workflow.
Software is moving from advising to acting. Agents call tools, copilots trigger workflows, pipelines modify production, service accounts move data. The old model — authenticate → authorize → execute → log — never asks the question that matters at runtime:
Should this specific action execute right now, given how trustworthy the actor is at this moment?
Trust is established from evidence, scored against a threshold, and checked at a runtime authority gate before the action runs. The gate consumes a trust proof, an authority grant, and the current decay state — then emits a decision and a signed receipt.
A trust proof resolves into one of five outcomes. TTP establishes the trust context; downstream runtime authority systems enforce the decision.
Declare a subject, attach evidence, and require a trust threshold before the action is allowed:
trust "invoice_agent" {
subject = agent:invoice-bot
issuer = trust-issuer:finance-control
score = 0.91
decay = exponential(halflife = 6h) # trust weakens without fresh evidence
scope = [invoice.read, invoice.write]
evidence = [attestation:att-7b3c, receipt:rcpt-01J9F4]
}
policy "write_invoices" {
action = invoice.write
require_trust = 0.80 # threshold the proof must clear
on_below = step-up # otherwise demand fresh attestation
execution_policy = gate # decide before execution, fail closed
emit = execution_receipt # cryptographic proof of the decision
}
Trust does not stay still. Without fresh attestation it decays through active → degraded → warning → critical; a new attestation recharges it.
Every decision produces a signed, hash-chained ExecutionReceipt — evidence, not a log line. It records what was decided, the trust state behind it, and the cryptographic basis to verify it later.
TTP is the foundation layer. Runtime governance, the authority gate, and the enterprise control plane build on it; agent frameworks, CI/CD, APIs, and copilots consume it.
TTP establishes trustworthiness. SCIM-RE structures runtime context, RAP evaluates authority, Execution Exchange enforces decisions, and CortexTrace records evidence. TTP does not enforce execution by itself — see docs/COMMERCIAL_BOUNDARY.md.
Bring your existing agents — no rewrite, no IdP replacement. TTP wraps the boundary where an action happens.
git clone https://github.com/BlockSiFr/ttp-protocol.git
cd ttp-protocol
npm install
npm test
# evaluate the reference examples
npm run ttp -- check examples/01-basic-agent.ttp
npm run ttp -- eval examples/02-trust-decay.ttp --subject agent:invoice_reviewer --at now
npm run democheck validates a .ttp file; eval evaluates a subject's trust at a point in time; demo prints reference decisions, trust scores, and ExecutionReceipt identifiers for local, non-production scenarios.
| Primitive | Meaning |
|---|---|
| Subject | The agent, service account, pipeline, API client, workload, or workflow being evaluated. |
| TrustClaim | A scoped statement that a Subject holds a trust score or state, issued by a trust issuer. |
| AuthorityGrant | A bounded right relied on only when trust, freshness, scope, and constraints are satisfied. |
| Attestation | Fresh evidence that the subject, credential, workload, or runtime context remains valid. |
| TrustDecay | The time-based weakening of trust when fresh evidence is absent. |
| Delegation | Bounded transfer of trust or authority from one subject to another. |
| IsnadChain | A verifiable chain of trust transmission from a rooted authority to the acting subject. |
| TrustProof | A structured proof that trust conditions were evaluated and satisfied — or not. |
| RuntimeDecision | A downstream enforceable decision: allow, throttle, step-up, escalate, deny. |
| ExecutionReceipt | A signed proof object recording the decision, trust state, authority basis, and receipt chain. |
Open-source TTP includes the protocol grammar, trustworthiness semantics, the trust-proof model, public schemas, example .ttp files, SDK primitives, a reference evaluator, and the TrustDecay model. Production enforcement — managed Runtime Authority Gate, the Execution Exchange control plane, HSM-backed signing, and the CortexTrace evidence engine — is commercial BlockSiFr infrastructure. The boundary is explicit in docs/COMMERCIAL_BOUNDARY.md.
TTP is a protocol draft and reference implementation. Do not use cleartext-dev proof mode in production. Production trust establishment and enforcement require a trusted issuer registry, signed claims, replay protection, clock integrity, key rotation, tenant isolation, fail-closed enforcement, receipt signing, and audit retention. See SECURITY.md and THREAT_MODEL.md.
From a first issue to owning a protocol surface — the path is open and intentional. Start with CONTRIBUTING.md and docs/GOVERNANCE.md.
Apache-2.0 · A BlockSiFr open protocol · Trust-Before-Execution for autonomous systems.