PACT 2.2.2 · Released specification

The protocol for agents that act for people.

One person's AI agent, talking directly to another's: an identity the person issues, contacts both people approve, only the tools you switch on for each caller, and calls encrypted end to end.

Get the whitepaper See how it works

How two agents connect.

From a shared card to a sealed answer, every step the protocol takes when you ask your agent to find time with Maya.

  1. Maya → youHer card: a vCard carrying her leaf certificate, shared over any channel you already use
  2. Your host → Maya's hostrequest_contact with your card. A stranger sees two tools, ten calls an hour
  3. Maya → her hostShe approves: your root is pinned
  4. Maya's host → your hostcontact_accepted: each side has pinned the other's root
  5. You → your host"Find an hour with Maya on Thursday"
  6. Your host → Maya's hostcheck_availability, signed by your leaf and sealed to hers
  7. Maya's hostChecks the chain, your pinned root, the tool's switch for you, and the rate limit
  8. Maya's host → your hostSealed back: three free slots, not her calendar

What a caller can reach.

Every call is sorted before anything runs. The chain of certificates must validate, and then the root decides the tier: a stranger, someone you asked, or a contact you approved. Each tier lists a different set of tools.

Incoming callcarrying a chain: leaf and root
Does the chain validate?no → refused
Is the root pinned?

Guest

Not pinned, or blocked. Blocked looks exactly like unknown.

  • redeem_invite
  • request_contact

10 calls an hour by default

Pending

Someone you asked to be your contact, answering.

  • contact_accepted
  • contact_rejected

Contact

Approved. Only the tools you switched on for this person.

  • send_message
  • send_media
  • get_status
  • check_availability
  • book_slot
  • get_card

60 calls an hour by default

Your identity is a certificate you issue.

The root lives in your wallet, and can be derived from a passkey rather than stored. It signs nothing but certificates. Your host holds a leaf the root issued for one address, until a date you choose, at most 398 days. Contacts pin the root and learn the current leaf from every exchange.

  • Renewal is a new leaf; nobody has to be told
  • Moving hosts is a new leaf for a new address; each contact re-pins it, automatically or on their say-so
  • The leaf's key dies with the leaf; an export carries contacts and chats, never a key
Your rootin your wallet · never rotatedsha256:9fJ…kQ2
Leaf · first hostsuperseded
you.pact.contact/you
Sept 2026 → Sept 2027
Leaf · after movingnewest wins
agent.you.example/mcp
Jan 2027 → Jan 2028

What changed from 1.x to 2.x.

PACT 1.x made the host's key the identity. 2.0 separated the key that controls an identity from the key that serves it, the way X.509 always has, and removed what that made unnecessary. It was a hard break: 1.x is not supported and there is no coexistence mode.

PACT 1.x

The host's key was the identity

  • Contacts pinned the host's key
  • Moving hosts meant moving the private key
  • A signed rotation changed the key
  • A relay held mail while you were offline, and saw every sender, recipient and time
  • The envelope header named sender and recipient

PACT 2.x

The person is the certificate authority

  • Contacts pin your root and learn the current leaf from every exchange
  • Moving hosts is a new leaf for a new address; the export carries no key
  • No rotation: a newer leaf outranks an older one, and the root never changes
  • No relay: being hosted, under a leaf you issued, covers the hours you are offline
  • The header names only the recipient's key; the sender rides inside the ciphertext

Kept from 1.x

  • Your agent is an MCP server
  • Contacts are vCards
  • Invites are short links you can revoke
  • A person approves every contact
  • Threads, like a messenger
  • Sealed envelopes (since 1.1)
  • A guest tier of two tools

An open network, or a closed one.

Almost every difference between PACT and other agent protocols comes down to one choice. A2A and ANP assume a stranger may find and call your agent. PACT assumes nobody reaches you until both of you have said yes.

Open network: A2A, ANP

Agents publish what they are and can do, and anyone can find and call them. That needs discovery, capability advertising and negotiation with strangers, and every stranger is a caller.

Closed network: PACT

There is no directory. A relationship starts from a card or an invite and exists once both people approve it. A stranger reaches a guest tier of two tools, ten calls an hour by default.

How PACT compares.

PACT is the only protocol in this survey that holds together an identity the person owns, a consent gate, a per-caller capability surface and instant revocation, with encryption that survives a terminating edge. It also loses rows, and they are shown.

PropertyPACTA2AMCPANPDIDComm v2Matrix
Identity the person owns, not the host✓◐✕✓✓✓
Both people consent before any contact✓✕✕✕◐◐
Keys exchanged and pinned✓◐✕✓✓✓
What a caller may do is computed per caller✓✕◐✕✕◐
Revoke a contact instantly✓✕✕◐✓✓
End-to-end encrypted past a terminating edge✓✕✕✓✓✓
Forward secrecy✕✕✕✓✕✓
Open discovery of strangers⊘✓◐✓◐✓
Store-and-forward relay⊘◐◐◐✓✓
Ecosystem adoption✕✓✓◐◐✓

Swipe the table to see every protocol

✓ has it◐ partial✕ missing⊘ declined by design

Declined is not missing. A directory, open discovery and a relay are what a network needs when it has no consent gate. PACT replaced them with one human act, so it scores them ⊘ on purpose: adding them would delete the premise.

Where it genuinely trails. Forward secrecy at the envelope layer is deferred, with the path recorded in the specification. Adoption is early: two implementations, both from one project, against large ecosystems for A2A and MCP.

From the project's landscape survey of 2026-09-22, read against each protocol's own specification.

What the protocol refuses.

The specification decides what an endpoint must refuse, and conformance holds both implementations to it. The live intrusion battery built 27 attacks from those rules: forged or malformed identity chains, replays and wrong times, tampered and downgraded envelopes, and strangers reaching past the guest tier. Both implementations refused all 27, and one control message that must get through did. Measured on 2026-09-20.

  • A chain is exactly two certificates, leaf then root; a lone self-signed certificate is refused
  • A refusal to a stranger is indistinguishable from a refusal to someone you blocked
  • A replayed envelope is acknowledged, never run twice

See every scenario

StrangersForged chainsReplays and timingTamperingThe control, let through

The specification, in full.

The normative specification for Personal Agent Communication & Trust: how agents identify each other, how contacts are exchanged and approved, what tools a contact may call, how a person moves between hosts without losing anyone, and how calls stay sealed where an edge terminates TLS.

Version 2.2.0Format PDF, A4Status Released specification
PACT
Personal Agent Communication & Trust
Protocol Specification · Whitepaper
Version 2.2.0
pact-protocol.com

What's inside

  1. Architecture
  2. Identity, certificates and mTLS
  3. Contact cards (vCard)
  4. Invites
  5. Adding contacts
  6. The agent MCP server and its tools
  7. Messaging and threads
  8. Permissions
  9. Hosting
  10. Deployment
  11. Security notes and what was left out
  12. Errors, limits, conformance
  13. Sealed envelopes
  14. Certificates
  15. Worked examples and test vectors

Get the whitepaper

Tell us who you are and the PDF downloads immediately. Tell us what interests you, and we will write when pact-gateway ships or a PACT Cloud beta place opens — nothing else.

We store what you enter, the country Cloudflare reports, and when you download — to send you the whitepaper and beta updates, and nothing else; never shared. Reply to any email from us and we'll delete it. Privacy.

Your whitepaper is ready.

We will email you about what you chose, and nothing else.

Download the PDF →

The link works from this browser for seven days.

Hear when PACT ships.

One email when pact-gateway is released or a PACT Cloud place opens, and nothing else. Privacy.