EMILIA Protocol

<!-- Discord invite must be set to never expire with unlimited uses. A default Discord invite expires in 7 days and leaves a dead link on this page. -->

---

AI workers need authority, not constant supervision.

EMILIA is the authority control plane for autonomous work. A human or institution defines a finite operating mandate once; agents work unattended inside it; EMILIA Gate enforces each consequential unit of work at the executor or system-of-record boundary.

Gate is the commercial Consequence Firewall on that boundary. It verifies the authority the owner requires for the exact action, refuses before mutation, consumes accepted authority once, and leaves portable evidence of what the protected path admitted and later observed. Protocol proves. Gate prevents.

• Authority Brain maps supported declared action surfaces locally. No account, upload, or callback is required. Discovery creates no authority; the owner reviews the map.
• EMILIA Gate turns the approved map and operating mandate into preventive control on a fully mediated, credential-owning executor path.
• EMILIA Protocol is the open Apache-2.0 substrate for exact-action identity, native evidence verification, evidence composition, one-time admission, and portable work records.
• EMILIA Approver captures a device-bound exact-action human decision when the mandate or local policy requires fresh human authority. A human click is one authority source, not the default execution model.
• EMILIA Assurance Plane provides scoped verification, re-performance, conformance reports, and deployment evidence. It supports auditors, insurers, regulators, and customers; EMILIA is not an auditor or accredited certifier, and no public EMILIA certification program is operating.

Run the local map (npx @emilia-protocol/scan), choose one consequential workflow, and place Gate where the provider credential turns intent into work.

Start free by protecting one privileged MCP tool call. The first paid market is payer AI-assisted adverse medical-necessity determination, under one safety rule: no valid licensed-review evidence, no adverse determination. Missing evidence routes to lawful human review or a patient-protective fallback; it is not authority to withhold medically necessary care.

AI systems and repository reviewers: start with AI_CONTEXT.md. Current machine-readable evidence, provenance, assumptions, and exclusions are published at EMILIA-REPO-CONTEXT-v1. Archived or staged documents do not establish current implementation or IETF status. Public due-diligence evidence and claim boundaries: DUE_DILIGENCE.md.

Engineering evidence, not architecture claims

EMILIA ships a security case that reviewers can execute. The current repository resolves 35 security claims over 259 hashed evidence files, verifies 20 Tamarin lemmas across two composed Dolev-Yao models — 17 all-traces obligations and 3 exists-trace reachability witnesses — and preserves 8 deliberately weakened variants that produce concrete attack traces when load-bearing checks are removed. The live same-team conformance corpus contains 21 suites and 331 current vectors. Separately, an externally authored Rust verifier is pinned to the frozen 16-suite/164-vector bundle and a 359-case hostility campaign. The broader suite contains 8,854 automated tests across 532 files.

Production JavaScript and JSDoc surfaces are compiler-checked with TypeScript checkJs; the secure app has its own compatibility compiler project, while declarations and the public TypeScript SDK are checked in strict mode. This is complete configured production type-check coverage, not a claim that the repository was converted wholesale from JavaScript to TypeScript or that every JavaScript project has TypeScript's strict option enabled.

Each security claim names the enforcement path, positive and negative vectors, language coverage, formal scope or explicit gap, assumptions, exclusions, and evidence hash. Start with the human-readable evidence map, then inspect the resolved security case or run npm run check:security-case.

AEB-1: test the evidence-to-effect boundary

The open AEB-1 Consequence Admission Conformance pack tests the last control point before a consequential action: native verification, relying-party acceptance, exact CAID/action matching, evidence satisfaction, local authorization, atomic one-time reservation, INVOKING custody, separate provider-outcome and observed-effect truth, no-blind-retry behavior, and authenticated reconciliation.

npx @emilia-protocol/verify aeb-conformance --reference

It is format-neutral and self-run. A passing report is self-attested conformance evidence—not an audit, certification, production-deployment claim, or permission to execute an action.

For a focused executable proof of the repository's Gate path, run:

npm run proof:gate:reference

This command exercises local examples and focused service boundaries with generated keys, in-memory state, and mock provider behavior. It is useful local proof, not evidence of a real human, external bank, production deployment, or one end-to-end production integration.

Identity is not a job description

Identity says who or what is calling. Policy says what is generally allowed. Neither defines the finite job an autonomous worker may perform now: its mission, material-action limits, budget, required evidence, expiry, delegation rules, and exception path.

EMILIA keeps those questions separate:

| Layer | Question | |---|---| | Identity | Who or what is present? | | Policy | What is generally allowed? | | Authority | What exact work may this agent perform under this mandate? |

Credentials grant reach. Authority defines the job. Not every action needs a human; every consequential action needs valid authority.

At the foundation, EP Core still exposes three interoperable objects: a Trust Receipt carries attributable evidence, a Trust Profile represents structured trust state, and a Trust Decision records the relying party's policy-evaluated result. The authority-control-plane layers add exact action binding, finite mandates, admission, consumption, and outcome evidence without collapsing those objects into one claim.

---

Set the mandate once. Let the agent work.

The customer defines the mission, limits, evidence requirements, expiry, and exception rules. Local code may narrow that authority; it cannot invent or widen it. Gate binds each executable request to the mandate, admits it once inside a durable authority domain, and escalates only when authority is missing, stale, exhausted, or too narrow.

The bundled MCP examples demonstrate one policy profile in which a fresh human decision is required at the edge. They run the complete local loop—missing evidence refused, exact action signed, action admitted once, forged evidence rejected—without claiming that every autonomous action needs a human click:

node examples/mcp/payment-server.mjs    # release_payment  — refuses without a receipt
node examples/mcp/github-admin.mjs      # delete_repo      — refuses without a receipt
node examples/mcp/prod-deploy.mjs       # deploy_production — refuses without a receipt

The deeper composition demo executes a CAID-bound delegated payment through Gate's real bounded-capability path, then verifies the signed execution certificate offline:

npm run demo:receipt-program

It deliberately includes no blockchain or simulated zero-knowledge claim. See the receipt-program architecture for the production state and trust requirements.

Start with a dry run against your declared tool surface, then generate the reviewable integration files:

npx @emilia-protocol/scan protect ./tools.json
npx @emilia-protocol/scan protect ./tools.json --apply
node emilia/verify-setup.mjs

The generated local check uses explicitly ephemeral demo state and proves only that its synthetic handler was not called. Production requires a durable provenance ledger, a shared atomic consumption store, pinned keys, and the wrapper on every path to the real provider credential. See examples/mcp/ and /mcp.

Try it in 30 seconds

# Issue a receipt offline — no API key, no backend needed
npx @emilia-protocol/issue demo

# Add EMILIA to Claude / Cursor / Cline
npx -y @emilia-protocol/mcp-server

Try a real Face ID signoff → Approve an $82,000 wire with your own passkey. See what VERIFIED looks like. Forge the receipt. See it fail.

Verify any receipt in your browser — paste it in, nothing is uploaded.

---

How it works — one authority lifecycle

Run it yourself: node examples/crash-test.mjs — fully offline, no API key.

  [ MANDATE ]       [ EXACT WORK ]       [ VERIFY ]       [ ADMIT ONCE ]       [ RECONCILE ]
  mission, limits   canonical action     pinned native    consume before      preserve provider
  evidence, expiry  + occurrence         evidence         provider entry      and effect truth

Mandate. The authority source defines finite work. It can be a customer-signed operating program, bounded capability, required human decision, quorum, or a relying-party composition of native evidence.

Exact work. Gate binds method, origin, callee, target, occurrence, and every material field into the canonical executable object. Intent, a prompt, or ticket text is not that object.

Verify and admit once. Native artifacts remain native. The relying party pins trust and mapping profiles, evaluates the complete evidence requirement, makes the separate local authorization decision, and consumes the operation before the credential-owning adapter enters the provider.

Fresh human authority when required. A policy can require a WebAuthn/passkey decision bound to the exact action and deterministic display hash. This narrows the “what you saw is what you signed” gap; it does not prove comprehension, wisdom, legality, or outcome.

For enterprise deployments, Gate can additionally require an independently verified Authorization Server confirmation bound to that exact human evidence, the same exact action, the identity snapshot the AS actually observed, and the intended Resource Server key. The snapshot time and relying-party maximum age are explicit: a fresh token cannot make stale directory