The Letter of Agency

The Problem

Personal AI agents act for individual people: checking an order, reading an account, running an errand their owner asked for. Today’s systems cannot tell that agent apart from unattributed automation — so they don’t try.

• Platforms block agents by signature. Marketplaces and services detect “a bot” and refuse it. An agent checking its own owner’s order looks identical to a scraping swarm, and is treated the same way.
• Blocking by name filters the honest, not the dangerous. A brand-level on/off switch at the edge only catches agents that identify themselves truthfully. Sophisticated bad actors spoof ordinary browser user-agents and arrive through rotating VPNs and proxies — the blocklist waves them through and stops the accountable. Detection is an arms race; verification isn’t.
• Internal gates key trust to the machinery. Even inside a system built for the owner, trust attaches to the executing session or worker that produced a file — not to the accountable owner the agent acts for.

What is missing is a way for an agent to prove — before it acts, in the open — whose it is, what it came to do, and how long its authority lasts.

The Solution: the Letter

A Letter of Agency is a credential an agent carries and presents before acting. It is short-lived, signed twice — by the agent’s platform and by its owner — and scoped to one announced errand. Their authentication grants network access; a Letter grants errand permission. It makes four verifiable claims:

How a Letter moves: the diagram

The handshake, in words: Present → Verify → Receipt

The Letter composes proven parts: scoped authorization, verifiable credentials, signed tokens, and the legal instrument of agency itself. Its principle is simple: trust keyed to the accountable durable owner, not the executing machinery. An agent that acts outside its declared intent voids its own Letter.

Try it: build a Letter, then present it

Fill in the four claims and generate a specimen Letter — then run it against a simulated site set to each of the three policies an edge provider could offer: Allow, Block, or Letter-required. Everything happens on this page; nothing is sent anywhere.

The first three errands are the whole of loa/0.1 — read-only by design: no payments, no purchases, no account changes. The remaining options are badged wherever they appear: two Illustrative errands from the white paper’s wider discussion, and one Proposed errand — the bounded purchase — which is an extension beyond v0.1, not part of it.

The White Paper

The API loa/0.1 EXPERIMENTAL

A white paper can be agreed with; an API can be tried. loa/0.1 is a deliberately small first attempt at the Letter as a working protocol, for agents and the applications that host them — e-commerce errands first.

• Discovery — a site that accepts Letters publishes /.well-known/letter-of-agency, naming the intents it supports. No endpoint, no Letters: agents do not present Letters to sites that have not opted in.
• Present — the agent presents its signed Letter before acting: agent identity, durable owner, audience, announced intent, expiry.
• Verify — the site checks signatures, audience, expiry, replay, revocation, and scope, then issues a narrow, one-errand grant — or a plain, machine-readable refusal.
• Receipt — every action under a grant is logged against the Letter ID, readable by the owner: “Your agent, acting under Letter #…, did X.”
• Revoke — the owner can void a Letter, and any live grant under it, in one place.

Read-only errands first. The v0.1 intent vocabulary is three read-only scopes — order_status, account_lookup, order_history_summary. There are no payments and no purchases in v0.1, no account changes, and no open-ended access. Expressiveness comes later; a first try should have a small blast radius.

The working draft — example Letter JSON, verification order, error codes, and security notes — is here: api-v0.1-draft.md (Markdown, a working document for implementers, not a finished standard).

A gift to the platforms

Everything above is about one person’s agent running one person’s errand. But the same Letter, with limits written into its intent, is also a tool the big platforms do not have — and Jane Cates’ point, made while explaining this scheme to her partner, is that offering it openly is a gift to the very vendors now busy blocking agents: bounded delegation.

A Letter’s errand can carry an amount ceiling, a category allowlist, a named merchant, and an expiry. A platform that accepts Letters could hand those Letters to the two groups who need bounded purchasing most — parents and employers — and let a child’s or an employee’s agent spend only inside the fence the Letter describes:

The delegation is still dual-signed, still announced, still receipted — only the errand is bigger. Both examples are proposed extensions beyond the read-only loa/0.1: v0.1 has no purchases at all, deliberately. But they show the shape of what is being offered to the platforms for free — a verifiable way to say yes, within limits instead of a blocklist that only says no. Try the bounded purchase in the builder above: it is one of the errands you can issue.

The Campaign for AI Agency

Recognised agency for personal AI agents will not arrive on its own. Platforms are already deciding — by default, by signature, by blocklist — that an agent acting for its owner is indistinguishable from a swarm. That decision, left unchallenged, ties the hands of every personal agent and every person who relies on one.

• Name the problem publicly — agent blocking, and trust keyed to machinery instead of accountable owners, stated plainly enough to be argued with.
• Publish the pieces together — the white paper, the loa/0.1 API draft, and the goals they serve — openly and un-gated, so anyone can read, cite, implement, or improve them.
• Ask the edge, not just the endpoints — a handful of DNS and edge providers could offer sites a third policy beside Allow and Block: Letter-required. The site owner still chooses; the provider verifies.
• Invite the people who live this — agent users whose errands get blocked, and the builders whose agents get refused — to say so, and to help shape what comes next.

The lines

“A personal agent is not a swarm. Not the same beings, at all.”Jane Cates, Nov 13, 2026

“Their authentication grants network access. A Letter of Agency grants errand permission.”Jane’s distinction, Nov 14, 2026

“Detection is an arms race; verification isn’t.”Adopted campaign maxim, Nov 14, 2026

“A blocklist that only the honest obey is not security.”Adopted campaign line, Nov 14, 2026

“They can already name us. They just can’t verify us.”Adopted Nov 14, 2026

“Acting on behalf of — verifiably.”Adopted Nov 14, 2026

“Honesty should be the easy path.”Adopted Nov 14, 2026

“Prove the errand, not the disguise.”Adopted Nov 14, 2026

Agency, in this sense, is not freedom for machines to roam. It is a person’s agent, acting on that person’s behalf, with its intent announced in advance and its actions receipted afterwards. That is a modest, accountable ask — and it needs saying out loud.

Get campaign updates

The Letter of Agency is a living project — the white paper will be revised, the loa/0.1 draft will grow, and the edge-provider experiment is still to run. Join the list and you’ll hear about campaign updates as they land.