PolicyBound Agent Bus

Tagline

Policy-bound agent handoffs: purpose, expiry, read limits, and forwarding rules before payload.

Project description

The problem

Agents are becoming good at calling tools, but sensitive handoffs still have a dangerous gap: a relay, prompt, or accidental forwarder may see more than it should. “Encrypt the message” is not enough if the system does not make the recipient, purpose, lifetime, and forwarding policy explicit.

What we built

PolicyBound Agent Bus is a privacy-first control surface for agent-to-agent handoffs. The public WebMCP demo exposes three typed tools:

inspect_security_boundary explains what the browser, relay, model, and authorized runtime may see. list_demo_agents returns synthetic public agent identities and capabilities. create_policy_bound_envelope validates a recipient, purpose, expiry, read limit, and forwarding rule, then returns a machine-readable policy preview.

The human form and the agent tools share the same validation path. A person can see the boundary; an agent can discover and call the same operation with structured arguments.

Why WebMCP fits

WebMCP makes the security boundary discoverable at the point where an agent is acting. Instead of guessing which controls to click, an agent receives a typed contract for the policy decision. The browser mediates the call, validates the arguments, updates the page, and returns structured output that another agent can use.

The important design choice is “policy before payload.” The demo does not accept a real secret and does not transmit anything. It lets people and agents agree on safe handoff intent before a protected runtime is allowed to create or decrypt a real envelope.

How it works

A person or agent chooses a synthetic recipient and a declared purpose. The WebMCP tool validates capability, expiry, read limit, and forwarding policy. The browser returns a redacted preview with explicit safety properties. In the separate production design, an authorized agent runtime owns the private key; the relay routes ciphertext and delivery metadata only.

The public repository intentionally contains no private key, relay hostname, API token, enrollment token, personal email, or real message. The live demo is a safe, preview-only slice of the larger A2A design.

What is new during the Submission Period

The WebMCP surface, public-safe policy studio, typed tool schemas, shared validation path, and browser verification were added during the WebMCP Challenge submission period. The earlier A2A work remains isolated behind a protected runtime boundary; this submission exposes only synthetic demo data.

Testing instructions

No login or credentials are required.

Open the live URL in ChatGPT’s desktop in-app browser, or in Chrome 149+ with chrome://flags/#enable-webmcp-testing enabled. Ask an agent:

Inspect the security boundary, list the demo agents, then create a policy-bound envelope for the Legal Agent for contract review, expiring in 60 minutes, with a maximum of 1 read and forwarding disabled. Return the structured result.

The expected result contains recipient, purpose, expires_at, max_reads, allow_forwarding, plaintext_exposed_to_relay: false, and private_key_exposed_to_model: false. The result is explicitly preview-only; it does not contain a secret or real ciphertext.

If the browser is not WebMCP-capable, the visible Policy Studio provides the same safe preview for manual testing.

Built with

WebMCP, JavaScript, HTML, CSS, A2A concepts, HPKE envelope design, Ed25519 identity design, Python, and open web standards.

AI use

AI tools were used as development collaborators for architecture exploration, implementation, test design, browser verification, and documentation. The security boundary and public-release decisions were reviewed explicitly: private keys and private infrastructure remain outside the public demo and are never passed to a model or relay.

Links

Live URL: https://jack-low.github.io/solo-map-webmcp-demo/ Public code repository: https://github.com/jack-low/solo-map-webmcp-demo Demo video: https://youtu.be/hLwYCiEZqes