VAC Protocol — Developer SDK

How It Works

1

Issue Token

Human authenticates (API key, SSO, or biometric). Gets a signed authority token with scoped permissions.

2

Record Actions

Agent performs actions. Each one is recorded in the execution graph with trust score, scope, and outcome.

3

Human Reviews

Human rates the outcome (approved/flagged/rejected). Feedback drives agent reputation and smarter routing.

Quickstart — The Simple Path

Already have an agent? Two API calls and you're in the execution graph.

cURL

Python

JavaScript

bash# 1. Issue an L1 token (API key level — instant, no biometrics)
curl -X POST https://vac-system-production.up.railway.app/v1/vat/issue/l1 \
  -H "Content-Type: application/json" \
  -d '{"developer_email":"you@company.com","agent_id":"my-agent","resources":["calendar:events"],"actions":["read","write"]}'
# Returns: { jti: "vat_root_...", provenance_ref: "prov_...", compact_jwt: "eyJ..." }

# 2. Record an agent action (one call — simplest integration)
curl -X POST https://vac-system-production.up.railway.app/v1/vat/record/action \
  -H "Content-Type: application/json" \
  -d '{"vat_jti":"YOUR_TOKEN_JTI","action":"read","resource":"calendar:events","result":"success"}'
# Returns: { recorded: true, aar_id: "aar_...", provenance_ref: "prov_..." }

# 3. Human rates the result
curl -X POST https://vac-system-production.up.railway.app/v1/vat/aar/AAR_ID/feedback \
  -H "Content-Type: application/json" \
  -d '{"rating":"approved","note":"Result was correct"}'

# 4. Check agent reputation (built from execution + feedback)
curl https://vac-system-production.up.railway.app/v1/vat/reputation/my-agent
# Returns: { execution_score: 1.0, feedback_score: 1.0, combined_reputation: 1.0 }
    

pythonimport requests

BASE = "https://vac-system-production.up.railway.app"

# 1. Issue L1 token
token = requests.post(f"{BASE}/v1/vat/issue/l1", json={
    "developer_email": "you@company.com",
    "agent_id": "my-agent",
    "resources": ["calendar:events"],
    "actions": ["read", "write"]
}).json()

# 2. Your agent does its thing, then record it
result = agent.read_calendar()  # your existing code

aar = requests.post(f"{BASE}/v1/vat/record/action", json={
    "vat_jti": token["jti"],
    "action": "read",
    "resource": "calendar:events",
    "result": "success"
}).json()

# 3. Human feedback
requests.post(f"{BASE}/v1/vat/aar/{aar['aar_id']}/feedback", json={
    "rating": "approved"
})

# 4. Check reputation
rep = requests.get(f"{BASE}/v1/vat/reputation/my-agent").json()
print(f"Reputation: {rep['combined_reputation']}")
    

javascriptconst BASE = 'https://vac-system-production.up.railway.app';
const post = (path, body) => fetch(`${BASE}${path}`, {
  method: 'POST', headers: {'Content-Type': 'application/json'},
  body: JSON.stringify(body)
}).then(r => r.json());

// 1. Issue L1 token
const token = await post('/v1/vat/issue/l1', {
  developer_email: 'you@company.com',
  agent_id: 'my-agent',
  resources: ['calendar:events'],
  actions: ['read', 'write']
});

// 2. Record action
const aar = await post('/v1/vat/record/action', {
  vat_jti: token.jti, action: 'read',
  resource: 'calendar:events', result: 'success'
});

// 3. Human feedback
await post(`/v1/vat/aar/${aar.aar_id}/feedback`, { rating: 'approved' });

// 4. Reputation
const rep = await fetch(`${BASE}/v1/vat/reputation/my-agent`).then(r => r.json());
console.log(`Reputation: ${rep.combined_reputation}`);
    

Use Cases

🤖

Multi-Agent Workflows

Delegate authority from human to agent to sub-agent. Scope narrows at every level. One revoke kills the entire chain.

📊

Execution Graph

Every action recorded. Query by workflow (provenance_ref), agent, action type, or time range. Agent reputation builds from real data.

🏥

Regulated Industries

Healthcare, finance, legal, defence. Tamper-evident audit trail with human feedback ratings. Policy assertions (HIPAA, SOC2, NIST ZTA) in every token.

Pricing

API Reference

Endpoints

POST /v1/vat/record/action Record an agent action (simplest integration)

One call: authorize + record + complete. Simplest way to add any action to the execution graph.

{ "recorded": true, "aar_id": "aar_e11bbdf3c1d4", "provenance_ref": "prov_4074e6f503a3", "trust_score": 0.4, "delegation_depth": 0 }

POST /v1/vat/issue/l1 Issue L1 token (API key level — instant)

Issue a root authority token. No biometrics needed for L1. Returns Ed25519-signed JWT with scoped permissions.

{ "jti": "vat_root_850fcb1c7e03", "provenance_ref": "prov_4074e6f503a3", "compact_jwt": "eyJhbGciOiJFZERTQSI...", "claims": { "vac_trust_score": 0.4, "vac_scope": { "resources": ["calendar:events"], "actions": ["read", "write"] } } }

POST /v1/vat/authorize Check permission before acting (full control)

Pre-flight check: is this action within scope? Creates a pending AAR. Use with /complete for the full lifecycle.

{ "authorized": true, "aar_id": "aar_3dc53332e417", "trust_score": 0.4, "provenance_ref": "prov_...", "human_ref": "sha256:7af91dcf...", "assurance_level": "L1" }

POST /v1/vat/aar/{id}/feedback Human rates agent action

Rate an action: approved, flagged, or rejected. Immutable once set. Feeds into agent reputation.

{ "aar_id": "aar_3dc53332e417", "rating": "approved", "feedback_at": "2026-03-10T09:42:15Z" }

GET /v1/vat/reputation/{agent_id} Agent reputation score

Two-dimensional: execution_score (from AAR outcomes) + feedback_score (from human ratings). Combined 60/40.

{ "agent_id": "agent:my-agent", "total_actions": 47, "execution_score": 0.957, "feedback_score": 0.85, "combined_reputation": 0.914, "has_human_feedback": true }

GET /v1/vat/aar/provenance/{ref} Query entire workflow

One provenance_ref returns every action by every agent in a workflow. The execution graph query.

{ "provenance_ref": "prov_4074e6f503a3", "total_records": 12, "unique_agents": 3, "actions_by_type": { "read": 8, "write": 3, "delegate": 1 }, "results_by_type": { "success": 11, "error": 1 } }

View all 68+ endpoints →

Get Started

VAC Protocol — Patent Pending (1028+ claims, 16 filings with IP Australia)

Submitted to NIST NCCoE AI Agent Identity and Authorization project

SDK Overview · Full API Docs · Try Biometric Verification

OAuth for AI agents.

Quickstart — The Simple Path

Pricing is set per engagement during early access.

Endpoints

VAC is in early access.