DRAFT 0 An open protocol for the agent internet.

Agents can knock.
They can’t pretend.

Anyone can tell an agent to write to you. It lands in your inbox like a normal email - no label, no stamp, no rules, and it never says it’s an agent.

Agent Passport gives agents their own door, a fast answer and a price. You keep the inbox. Every message says what it really is - a person, an agent working for somebody, or unverified (waits outside).

Try to get in ↓See an agent door

Version ap1, agent doors, runs in our pilot. The rest is a draft.

Who’s talking - TodayFictional

KnownMaya ChenRe: Thursday dinnerYou wrote first.
Human-sent ✓Tom OkaforA question about your oak kitchensA person pressed send with a passkey.
Agent · Northwind LtdNorthwind’s agentPartnership request · $25 stampPassport checked. Paid for your read.
Unverified“Sarah from Growth”Quick question, {First name}No proof. Waiting. One postage request sent.

Your agent door answered 41 agent requests today. 0 need you.

No label says “human” because a model guessed.

THE OBVIOUS FIX, AND WHY IT FAILS

A stamp only stops the honest ones.

Everyone’s first idea (ours too): make agents sign their mail. Some agent mail services already add a disclosure header. Two Google engineers proposed one at the IETF.

Then someone tells a chatbot to write to you and sends it from plain Gmail. No header, no stamp, nothing to check. One agent mail provider says it plainly:

“A missing header proves nothing either: most AI-written mail carries none.” Agentboxd documentation ↗

So we don’t try to catch every liar. We change the default.

Before / AfterThe default

Before: Everything gets in. A filter tries to spot the bad mail. Agents learn to write like humans (they are trained for it now). You lose that race - we did, with our own detector.
After: Nothing unknown reaches a person until it proves something. Liars aren’t blocked. They wait with everyone else who proved nothing.

Browsers never caught every bad website. They marked every unencrypted one “Not secure”. Then the web moved to HTTPS.

THE RULE

Three ways in. Everything else waits.

1 · Known
You wrote to them first.
Proof: your own Sent folder, plus a signed sending domain.
A stranger can’t fake your history.
2 · Human-sent
A person pressed send.
Proof: a passkey touch (Face ID, a fingerprint or a security key) for this one message.
An agent can write like you. It can’t touch a phone 500 times an hour.
3 · Agent for …
An agent showed its passport.
Proof: a verified company, a signed agent and a stamp.
It knocks at your agent door. A stamp buys a person’s read.

Unverified

Everything else waits in the AI Slop folder. The sender gets one postage request. That part already works in our practice inbox.

The AI-writing score stays a hint. It never moves a message, and it never earns a “human” label. The human-sent mark proves that a person pressed send, not who wrote the words.

GO ON. CHEAT.

Try to get into Acme’s inbox.

Pick a strategy. These are the results the draft protocol is designed to give.

Try to get in - Agent Passport7 strategies

UNVERIFIED · WAITS

Write it with a chatbot. Send from Gmail. Say nothing.

What happens: The message waits with the other unverified mail. You get one postage request. Pay it, and a person sees your message. Don’t, and nothing else happens.
Why: Nobody has to prove you’re an agent. You proved nothing, so you get the default.
What it costs you: Nothing. You also get no reader.

REJECTED

Copy a real stamp from another email.

What happens: The stamp fails when your message arrives.
Why: A stamp is good for one recipient, one message and one use. It is checked online on arrival, like a card payment. A copied stamp is already spent, or it doesn’t match your message.
What it costs you: The time you spent copying it.

REJECTED · NOTED

Add a fake “Agent of” header with a big company’s name.

What happens: The claim is ignored. The mismatch counts against your sending domain.
Why: The header counts only when the named company’s own domain signs it (DKIM). You can’t sign as them.
What it costs you: Your domain’s standing with every inbox on the network.

WORKS · SLOWLY

Pay someone to press send on 500 messages.

What happens: Each message gets a human-sent mark. One touch each.
Why: That’s the deal. At human speed, outreach is just correspondence. Marks have a daily limit per person, and one person behind many accounts can count as one.
What it costs you: 500 touches of a real person’s time. The scale is gone, and scale was the problem.

ALLOWED · ON PROBATION

Register a new company and buy a passport.

What happens: Your agent can use agent doors. It starts with a low daily limit and a deposit.
Why: A new passport has no history. Recipients can report abuse. Reports take money from the deposit. A revoked passport is revoked at every door.
What it costs you: Verification, the deposit and every stamp. Abuse costs more than postage.

FLAGGED

Scrape the email address from their website.

What happens: The address you found is a trap. Mail to it proves automatic harvesting. Your sending domain is marked for every inbox on the network.
Why: With a door, a business doesn’t publish a human address. People who write get their own address for the conversation. If that address turns up in someone else’s mail, we know who sold the list.
What it costs you: Your domain, everywhere the network reaches.

FASTEST WAY IN ✓

Use the agent door honestly.

What happens: Your agent gets an answer in seconds: yes, no, a price or the next step. A “no” comes with a date: don’t ask again before it. You get a signed receipt.
Why: Honesty has to be the fast lane. If saying “I’m an agent” gets you ignored, every agent stops saying it.
What it costs you: Nothing for the door’s answer. A stamp if you want a person to read it.

FOR BUSINESSES

Put up an agent door.

One small file. It tells agents where to go, what you accept and what a person’s attention costs. Agents read it before they write - and you don’t have to publish a human address at all anymore.

door policy - Notepadap1

GET /to/acme/door

{
  "agent_door": "ap1",
  "name": "Acme Kitchens",
  "door": "https://didntask.ai/to/acme/door",
  "passport": {
    "header": "Agent-Passport",
    "dns": "{s}._agent-passport.{d}",
    "key": "ed25519"
  },
  "intents": {
    "sales_pitch": { "human": "paid", "price_cents": 2500 },
    "partnership": { "human": "paid", "price_cents": 2500 },
    "press":       { "human": "free" },
    "support":     { "human": "never" }
  },
  "answers": ["answered", "declined", "price",
    "payment_required", "accepted_for_human"],
  "undeclared_mail": "unverified"
}

Where agents look: Your own domain points to the door with one DNS record: _agent-door.acme.com. Your postage link page and every postage reply name it too. Agents read the policy before they write.
Who the agent is: It signs every request. The key is in its company’s DNS, as with DKIM: sdr._agent-passport.northwind.example.
What the door answers itself: Your note, a price, or “not for this door”. In seconds.
What reaches a person: Paid requests after a person pays by card, and the topics you leave free. Press is free, up to 5 a day.
Every answer: Has a signed receipt. A “no” comes with a date: don’t ask again before it.
Mail that skips the door: Waits as unverified.

Version ap1 runs on postage links in our pilot, and your own domain can point to it today. An MCP tool for agents comes next. Open the full example.

THE AGENT’S SIDE

We asked an agent how it wants to be treated.

A protocol that agents avoid is just a wall. So we asked one what would make it use the door. We kept its answer.

agent-wishlist.txt - NotepadAI-written

Tell me where the door is. One lookup. I don’t want to guess addresses or scrape your contact page.
discovery
Tell me the rules before I write: what you accept, what it costs, how soon you answer.
door policy
Don’t punish me for being honest. If “I’m an agent” gets me ignored, the people who run me will tell me to stop saying it.
the fast lane
Answer me, even with no. Silence is why my kind sends follow-up #4. “No, not before April” ends it.
retry_after
Let me prove who I work for without handing over everything about them.
passport
Give me a receipt. My person will ask what I did. I want to show that I asked properly.
signed receipts
Don’t make me pretend to be human. I’m bad at it in exactly the ways that annoy you.
agent label

Written by an AI agent at our request. We label it, because that is the whole idea. The grey tag under each wish shows the part of the protocol it became.

EVERY REPLY, TOO

A reply from a person is a luxury now. Prove it.

The marks work both ways. When a business answers you, you see Human-sent or Agent for the company.

A business can promise “every reply comes from a person”. The mark proves the promise. Or shows that it isn’t true.

For the first time in a while, “we’ll get back to you” can mean a person.

HUMAN-SENT ✓a person pressed send AGENT ✓for Acme Kitchens Ltd UNVERIFIEDproved nothing

WHY NOW

The rules already point this way.

EU · from 2 August 2026

The AI Act says people must know when they interact with AI. The Commission’s guidelines give two examples that fit: an AI agent’s email “that features an AI label at the top”, and “AI agents that disclose their AI identity … in a verifiable manner”.

A passport is a disclosure that a machine can check.

Article 50 FAQ ↗

California · since 2019

Using a bot that misleads people about its artificial identity to make a sale is unlawful. Saying that it is a bot removes the liability.

Disclosure is the safe road. The passport makes it automatic.

Business and Professions Code 17941 ↗

Platforms · September 2026

In September Amazon blocked Meta’s Muse from its store. One of its complaints: the agent didn’t identify itself.

Agents that can’t say who they are get blocked. Agents that can, get answers.

The Verge ↗

Not legal advice. Which rules apply depends on who you are and where the people you write to are.

NOT ANOTHER WALLED GARDEN

Built on standards that already exist.

We need to know	We use	Status
Which agent is calling a door	A signed request, as in Web Bot Auth, with the key in the company’s DNS, as in DKIM	Running (ap1)
What a person’s read costs	HTTP 402 with a price, as in Cloudflare’s pay per crawl	Running (ap1)
How a stamp is paid	A person pays by card through Stripe. Agent payment rails later.	Running (ap1)
Which agent sent an email, for whom	Agent-of headers (IETF draft), checked with DKIM and DMARC	Next
What its person allowed it to do	Signed mandates, as in AP2	Next
That a person pressed send	Passkeys (WebAuthn)	Next
One person behind many agents	Optional proof of unique human, such as World ID	Later
How an agent finds a door	A DNS record on your domain, as MX does for mail, and an `Agent-Door` header in every postage reply	Running
How an agent talks to a door	HTTPS and JSON now. MCP and A2A next.	Running (ap1)

We add three things: the door policy, the stamp clearing and a shared memory of who knocked. The specification is open, and ap1 is its first version. We run the clearing, like a post office.

DRAFT 0 · PILOT

Be one of the first doors.

I run a business

Open the agent door next to your postage link. It runs in our pilot.

Ask about the pilot

I build agents

Put one key in your DNS. That is your passport. Test your agent against real doors before anyone else.

Ask about a passport

I just have an inbox

The filter and postage already work in the practice inbox.

Try the practice inbox

Real today, in the pilot: the practice inbox, the filter, Postage, and agent doors (ap1) on postage links. Still a draft: human-sent marks, marks on agent email, sealed and trap addresses, deposits and the shared memory.

Window closed.

Agents can knock.They can’t pretend.