1
EMILIA Protocol: open authorization receipts for irreversible AI-agent actions
ProposalGrant
Closes July 12th, 2026$0raised
$15,000minimum funding
$60,000funding goal
Offer to donate
29 daysleft to contribute
You're pledging to donate if the project hits its minimum goal and gets approved. If not, your funds will be returned.
Project summary
EMILIA Protocol is open, Apache-2.0 public infrastructure — an IETF-standard receipt format, three independent verifiers, machine-checked formal models, and a new open benchmark — producing cryptographic, offline-verifiable proof of which named human approved an exact irreversible AI-agent action, under a stated policy, before it ran.
When an AI agent causes harm, blame flows to the most legible party — usually the model or its provider — and the human who made the call disappears. When a state-sponsored group manipulated Claude Code against ~30 organizations in Nov 2025, the U.S. Senate oversight letter went to Anthropic, not the human attackers. Decision logs don't fix this: a log is what the operator says happened, in a database the operator controls — testimony, not evidence. A receipt is portable, signed, and verifiable by anyone offline, forever — including parties who don't trust the issuer. This grant funds only the open public-good layer, not the company's commercial product.
What are this project's goals? How will you achieve them?
Four concrete, public, milestone-checkable open deliverables:
Open agent-accountability / escalation benchmark (headline). A versioned, Apache-2.0 corpus + runnable scorer testing (a) whether an escalation policy gates every irreversible action class without over-escalating, and (b) whether a prompt-injected agent can game the trigger — a shared yardstick the field lacks.
Advance the IETF standard to -02 and publish a second-implementer guide so a non-EMILIA party can stand up a conforming verifier (the path to real federation independence).
Extend formal-methods coverage (TLA+/Alloy) to WebAuthn challenge binding, the approver directory, and the m-of-n flow, all re-run in CI with counterexamples public.
Harden the three open verifiers + conformance suite and grow the adversarial corpus beyond today's 85 red-team cases.
How: this is hardening and completing infrastructure that already ships (I-D at -01, two npm packages, three interoperable verifiers, 26 TLA+ + 22 Alloy machine-checked properties at 0 counterexamples) — not starting from zero.
How will this funding be used?
~4–5 months of full-time founder work on the open deliverables only. ~70% founder time (benchmark, formal-model extension, standard); ~20% verifier hardening + conformance tooling; ~10% independent review (a formal-methods/security reviewer) + the IETF process. No commercial-product work is funded here.
Minimum ($15,000) vs. full ($60,000): the minimum funds the open benchmark v0 — the single highest-half-life public good — shipped Apache-2.0 with a runnable scorer. Full funding adds the standards advance (-02 + second-implementer guide), the formal-methods coverage extension, and verifier/conformance hardening.
Who is on your team? What's your track record on similar projects?
man Schrock, sole founder, shipping in public: an IETF Internet-Draft at -01; two npm packages live (@emilia-protocol/verify, @emilia-protocol/issue — run npx @emilia-protocol/verify receipt.json today); three interoperable verifiers (JS/Python/Go) + a conformance suite; 26 TLA+ and 22 Alloy machine-checked properties at 0 counterexamples, re-run in CI; 85 red-team cases; two essays ("The Model Is the Crumple Zone," "Why Authorization Is Not Proof"). Every claim is independently checkable in the open-source repo and on npm — nothing here rests on trusting the applicant.
What are the most likely causes and outcomes if this project fails?
Honest risks: (1) rendering faithfulness — cryptography proves a key signed a hash, not that the human saw the true action; mitigated, with the residual stated plainly. (2) Federation independence isn't yet met — the second operator is EMILIA-run; making it real (an external conforming operator) is a goal, not a claim. (3) Solo bus-factor. Crucially, the failure mode is bounded: because everything is open, Apache-2.0, and reproducible from the public repo, the benchmark, spec, and proofs still ship and benefit the whole field even if the company stalls. The public good survives independent of the applicant.
How much money have you raised in the last 12 months, and from where?
0 — self-funded/bootstrapped by the founder to date; no outside capital raised