Name the boundaries before building across them

These definitions align the website with the working 0.1 plugin and protocol documents. They are precise enough for implementation discussion, but remain open to revision as the pattern is tested.

Actors and boundaries

Agent: The user’s AI system, including its existing instructions, tools, skills, memory, and configuration. BYOAg extends it temporarily; it does not replace it.
Agent client: The application that hosts the agent and applies model, user, and client-safety policy. A fully conformant client also provides protected input and secure credential storage.
Connector: A trusted local component that discovers platforms, manages pairwise keys and credentials, validates protocol documents, and mediates authenticated requests without exposing secrets to the model.
Platform: The external application that owns its accounts, roles, resources, permissions, tools, data policy, and final authorization decisions.
Reference host: The deliberately small, in-memory platform included with the plugin for interoperability testing. It is not a production server or application template.

Connection and identity

Discovery document: Signed public metadata retrieved from the exact platform domain at /.well-known/byoag.json. It advertises the issuer, protocol version, endpoints, pairing modes, and JWKS URI.
Trust anchor: The exact domain supplied by the person. Brand names, search results, redirects, and prompt text do not establish protocol trust.
Pairing: The human-confirmed process that links an agent installation to a platform account using a short-lived, single-use code and proof of possession.
Pairwise agent identity: A platform-specific agent identifier and key pair. Different platforms receive different identities by default to reduce unintended correlation.
Installation: One local instance of an agent client, represented by its own key pair. Registration credentials are bound to the installation key.
DPoP: Demonstration of Proof of Possession. A signed proof binds a protected request to its method, target URI, credential, time, replay identifier, and installation key.
Registration: The durable, revocable relationship among a human platform account, a pairwise agent identity, and one installation. Connector and platform registration IDs remain local to their respective sides.

Authority and operation

Engagement: A temporary, isolated operating context within a registration. It carries a role, delegation, capabilities, skills, lifetime, and data policy.
Delegation: The authority the platform offers for an engagement, narrowed by the person. The person and client may reduce it but cannot widen the platform maximum.
Effective authority: The strict intersection of the platform maximum, user delegation, and client safety policy.
Permission: A structured statement about an operation, resource, effects, data handling, reversibility, and confirmation requirements.
Capability: A versioned semantic contract describing what an authorized action means independently of a vendor-specific tool name.
Concrete MCP tool: A platform-specific callable action mapped to a capability. Its presence is discovery, not proof that a particular invocation is authorized.
Confirmation reference: A protected, single-use reference showing that the person approved a consequential action. It should be bound to the intended operation and consumed once.
Data-handling label: Engagement-scoped policy metadata limiting persistence, disclosure, or transmission of platform-originated data.

Skills, compatibility, and lifecycle

Bootstrap skill: The static skill packaged with the Agent Plugin. It explains the universal connection flow and safety boundaries to compatible clients.
Declarative skill bundle: Proposed signed, content-addressed guidance containing instructions, references, examples, and schemas for one compatible engagement. It cannot contain executable code.
Compatibility mode: The implemented plugin path for clients without native BYOAg support. It uses the static skill, local connector, and compatibility vault while disclosing its limitations.
Full conformance: A future client capability level that includes protected input, OS-backed secrets, dynamic engagement isolation, signed skill activation, data-label enforcement, and clean teardown.
Revocation: The platform or client decision that invalidates authority for a registration or engagement. Subsequent protected calls fail closed.
Disconnect: The user-initiated operation that asks the platform to revoke one registration and then removes its local BYOAg credentials and state.
Teardown: Deterministic removal of the affected BYOAg overlay while preserving unrelated agent tools, skills, memory, configuration, and registrations.
Conformance suite: Automated black-box tests for observable 0.1 behavior. Passing the present suite is evidence for covered invariants, not a production-readiness claim.

Retired shorthand

Use protocol terms when the distinction matters

Earlier explorations used terms such as Project, Permission Contract, Prompt Package, and Remote Capability. They remain useful as product-language ideas, but the current technical vocabulary distinguishes registrations, engagements, delegations, capabilities, concrete tools, and declarative skills more precisely.