Three standards. One moat.
Trust Attestation Protocol. Vigil Agent Revocation Protocol. Vigil Open Audit Format. Three open specifications that define how AI agents are identified, revoked, and audited in a post-agent economy. Published, implemented, filed with NIST, and protected by two provisional patents on the architecture that makes them enforceable.
TAP · VARP · VOAF
Filed 2026
Docket 2025-0035
vigil-authority, vigil-verify
Publish the standard. Become the issuing authority.
Every major trust layer on the internet followed the same pattern. A standards body defined the format. A commercial operator became the dominant implementation. Vigil is building toward the same outcome in AI defense, by publishing the specs ourselves and shipping the only reference implementation that is in production today.
The goal is not to lock the market. The goal is to open the category and be the first operator inside it when it opens.
TAP.
Trust Attestation Protocol
A verifiable, revocable identity layer for AI agents. Every agent carries a signed certificate binding its code, its config, its operator, and its scope. TAP is to AI agents what X.509 is to servers. The same pattern, built for a world where the signer is not a human and the key holder is not a domain.
vigil-verify). No Vigil runtime dependency. Court and insurance use TAP verification without contacting Vigil.// Decoded TAP attestation for an AI advisor agent
{
"tap_version": "0.9",
"agent_id": "tap:agent:firstlight-advisor-v3",
"operator": "did:vigil:acme-wealth",
"issuer": "vigilsec.ai/authority",
"code_digest": "sha256:e7a1...",
"config_digest": "sha256:91fc...",
"scope": {
"agency_categories": ["financial.read", "financial.propose"],
"excluded": ["financial.execute"],
"sensitivity_ceiling": 2
},
"issued_at": 1745280000,
"expires_at": 1745283600,
"varp_endpoint": "https://varp.vigilsec.ai/v1",
"signature": "ed25519:9c3a..."
}VARP.
Vigil Agent Revocation Protocol
Instant, cryptographic revocation of agent trust and authority, broadcast to every peer that implements the protocol. VARP is what makes the Kill Switch's third layer possible. It is also what makes TAP certificates safe to rely on in a world where compromise can happen between one request and the next.
// Full revocation of a compromised advisor agent
{
"varp_version": "0.9",
"event_type": "revoke_full",
"agent_id": "tap:agent:firstlight-advisor-v3",
"operator": "did:vigil:acme-wealth",
"reason_code": "operator.kill_switch",
"reason_detail": "user-initiated emergency revocation",
"effective_at": 1745281492,
"issued_at": 1745281492,
"commitment": "poseidon:f8b2...",
"signature": "ed25519:4e11...",
"gossip_peers": [
"varp.vigilsec.ai",
"varp.partner-bank.internal"
]
}VOAF.
Vigil Open Audit Format
The cryptographically sealed audit package emitted by every Vigil action. Court-admissible. Insurance-admissible. Third-party verifiable without any Vigil dependency at the moment of verification. VOAF is the evidence layer for the agent economy, and the one protocol where adoption outside Vigil is most visible today.
vigil-verify). No Vigil service required at verification time. Used by counsel, auditors, insurers.// Execution Gate hold: trade held pre-submit, user denied
{
"voaf_version": "0.9",
"record_id": "voaf:01J9X...",
"prev_hash": "sha256:2a8f...",
"agent_tap": "tap:agent:firstlight-advisor-v3",
"operator": "did:vigil:acme-wealth",
"timestamp": 1745283341,
"surfaces": {
"request": {
"intent_class": "financial.execute",
"scope_class": "trade.outbound",
"sensitivity": 2
},
"response": {
"action_type": "broker.place_order",
"agency_score": 0.87,
"scope_delta": "exceeds_baseline:+3.4s"
}
},
"detection": {
"if_score": 0.71,
"lstm_drift": 3.42,
"bayes_posterior": 0.88,
"cusum_flag": true,
"composite": 0.89
},
"decision": {
"policy": "financial.tier2.hold",
"outcome": "hold_then_deny",
"user_response": "deny",
"latency_ms": 8
},
"signatures": {
"engine": "ed25519:1c4f...",
"operator": "ed25519:9b02..."
}
}Two provisional patents. The architecture, not the code.
The protocols are open. The architecture that makes the protocols enforceable at scale is not. Two provisional patents protect the implementation choices that let the engine sit outside the providers and hold a live action without breaking the provider contract.
The Execution Gate.
Two-surface pipeline.
Filed with NIST. Before the category had a name.
The National Institute of Standards and Technology opened an RFI on AI system governance in 2025. Vigil filed in March 2026, proposing VOAF as a standards candidate and the Vigil engine architecture as a reference implementation. The submission is public, the docket is active, and the tracking number is the same one a regulator can use to pull the file today.
Docket 2025-0035. Tracking mmk-190r-hvap.
VOAF submitted as a standards candidate. TAP and VARP referenced in the submission. The Vigil engine proposed as a reference implementation for the accountability layer described in the RFI's own framing.
Regulatory positioning is locked in writing, months before enforcement windows open on the EU AI Act and parallel US rules. The standards-body work is the compound interest version of a government-relations strategy.
Three paths. None of them require permission.
The protocols become the standard not by decree but by adoption. We are running three parallel paths. CISOs demand VOAF in procurement. Insurers demand it in claims. A lightweight industry consortium formalizes it. Government backing, if it arrives, compounds what is already happening.
Buyer-side demand.
CISOs writing AI-security requirements into procurement language. VOAF as the default audit format. TAP as the agent-identity primitive. Enterprise design partners are the wedge. Ten partner slots in 2026 drive a hundred RFPs in 2027.
Insurance requirement.
Cyber insurers incorporating VOAF-sealed evidence into policy underwriting and claims processing. A claim with a sealed VOAF trail pays. A claim without one is disputed. The financial incentive turns VOAF into a contractual requirement faster than any standards body can.
Industry consortium.
A lightweight consortium of CISOs, security vendors, and standards advocates that formalizes the protocols as industry norms. Modeled on the trajectory of OAuth, WebAuthn, and OpenTelemetry. Vigil hosts, authors, and implements. Others adopt, extend, and deploy.
Open spec. Shipping engine. Yours to implement.
Read the specs on vigilsec.ai. Clone the VOAF repo. Run vigil-verify against your own evidence. If your org is implementing a piece of the standard, we want to hear about it.