Zero trust, and why it has to be everywhere
One idea runs under pap://, Papillon, and Chrysalis: nothing is trusted for where it sits or who it claims to be. It's trusted because it can prove, in the moment, that it's allowed. Here is what that means — and why a protocol for it is only worth anything if it's everywhere.
The perimeter is gone
The old security model is a castle and a moat. Build a wall, check identity once at the gate, and treat everything inside as friendly. That worked when "inside" was a building and a network you owned. It started failing when the work moved onto other people's clouds, and it breaks completely once the things acting for you are autonomous agents that appear, delegate, and vanish in seconds.
Zero trust drops the wall. There is no inside. Every request is judged on its own, every time, no matter where it comes from or what it claimed a minute ago. Access is never inherited — not from the network, not from a past login, not from being "one of ours." It is granted per action, against an explicit rule, and verified before anything runs.
Trust the inside
Authenticate once at the perimeter; assume everything past the wall is friendly. One breach of the wall exposes everything behind it.
Verify every action
No perimeter, no standing trust. Each action carries its own proof of authority and is checked before it runs. A breach is bounded to exactly what that one action was allowed to touch.
What this means for an agent
An agent doesn't get to act because it's yours, or because it signed in this morning. It acts because a signed mandate says it may — this action, this data, until this time — and a receipt afterward proves what it actually did. No mandate, no action. Wrong scope, no action. The check isn't a policy someone might review later; it sits in the path of the request, every time.
Why it has to be everywhere
A delegation isn't one party trusting another. It's a handshake between two chains of authority, and a handshake needs both hands. If the agent you're transacting with doesn't speak the protocol — doesn't check your mandate, doesn't co-sign the receipt — then your side is the only side holding the guarantee, which is no guarantee at all. It's the same reason a secure web connection only protects you if both ends negotiate it.
And it has to reach every hop, not just the edges. The point is to shrink what a compromise can reach — but the blast radius is set by the weakest link. One agent handed the full context because it didn't enforce scope, and the minimization everywhere else was for nothing. A perimeter with one soft spot inside is still just a perimeter. Zero trust that stops at the boundary is just a boundary.
A trust protocol is infrastructure, not a feature. It's worth the most when every party speaks it — and it leaks exactly where someone doesn't.
How we build it
We don't hand you a policy binder. We build the enforcement, in three parts that share one root of trust: your keys.
pap://
The protocol itself. Signed mandates set what an agent may see and do, a six-phase handshake negotiates it, an OS-level sandbox enforces it, and both sides co-sign a receipt. This is the layer that makes zero trust real between agents.
Read about pap:// →Papillon
A desktop canvas where you compose agents — each under its own mandate, each in a sandboxed session. Preview their plans, approve their actions, verify their results. No agent ever sees your full context.
Chrysalis
A registry you host yourself, so agents can be found and vouched for without a platform in the middle. You own the trust chain, and Baur Software is never in your blast radius.
Read about Chrysalis →Trust that's proven, not assumed
That's the whole stance. Nothing is trusted for its position or its promises — only because it can prove, in the moment, that it's allowed, and it leaves a signed record that it was.