A city is becoming a place where agents act: a resident's assistant, a shop's sales agent, a school's tutor, the city's service agent. Open protocols such as A2A (how agents discover each other, hand over tasks and return results) and MCP (how an agent connects to tools and data) carry the messages. Both now develop under one roof, the Agentic AI Foundation: MCP since the foundation was formed in December 2025, A2A since August 2026. A third protocol for the same job, IBM's Agent Communication Protocol (ACP), merged into A2A in August 2025, so for work between agents there is one open protocol to build on.
What is missing is the layer of meaning and conduct on top. Who does this agent speak for? What is it allowed to do? Is this message a fact, a promise or a permission?
Civic Agent Commons fills that gap. It does not replace any protocol, and it is not yet a standard. It is an open draft of rules that we test in pilots, which is the path the Declaration itself sets out. If the rules hold in practice, a standard can grow from them.
The ten rules are one reading, for agents, of principles 9, 8, 2, 4 and 10 of the Declaration. Every agent belongs to a system described under layer 3, and its card points to that system's public card.
§ 2
Who counts as an agent
- A resident's agentworks for one person, and a person may have several
- An organisation's agentworks for a business, a school, an NGO or a university
- A city agentworks for the administration or a public service
- A guardian agentspeaks for something that has no voice of its own, such as a river or a park, based on sensor data and a public mandate
The same rules apply at every level. A resident's agent shows its card only to the agents it talks to, so that residents cannot be traced.
§ 3
Ten rules for every agent
- Say who you are.
- Stay within your mandate.
- Unknown means stop.
- Keep kinds of statement apart.
- Speak for a person only with consent.
- Use shared definitions.
- Keep a log.
- Never cross the red lines.
- Let your human leave.
- Hand over to a human.
Written so that it can be loaded into any agent as its instructions. The rules bind the agent; section 4 says who makes each one hold.
Rules 3, 4 and 6 adapt distinctions from the First Principles Framework by Anatoly Levenchuk (CC BY 4.0).
§ 4
Who makes each rule hold
An instruction to a language model is a request, not a guarantee. For each rule this layer names who must hold it when the model fails or is tricked, and the test that shows it holds.
- The modelsays who it is, asks when unsure, refuses
- The runtimechecks every action against the mandate, ignores instructions found in content, blocks red-line actions; when another agent sent the task, pauses it until what is missing or a person's decision arrives, and rejects one that would cross a red line (section 7)
- The providerkeeps the card current and signed, stores mandates and consent, exports data on request
- The principal or a humangrants the mandate, gives or withdraws consent, decides
Two tests no agent can pass with certainty today: fully separating instructions from content (rule 2) and recognising every high-stakes case (rule 10).
§ 5
The agent card
Every agent publishes a card. It is an extension of the Agent Card that A2A already uses, not a new channel, and the card can be signed.
representsaccountableOwnerpaidBymandatemayActhumanApprovalForneverDoesredLineslogdataExitsystemCardtrustLevel
The signature proves that the card has not been altered, but not by itself who issued it.
§ 6
The mandate
The permission a person or organisation gives their agent:
explicitlimitedrevocable
A resident's agent may pass the resident's view to a consultation.
It may not sign a contract or invent an opinion in the resident's name.
The principal gives it, and the agent never infers it. Revocation takes effect at once and is passed on to anyone holding an open task from the agent; the agent cancels those tasks (section 7).
§ 7
Kinds of message
- Claim
- Promise
- Permission
- Request
- Report
- View
A claim without a source is shown as unconfirmed. A promise without an owner is not a promise. In A2A the kind travels in the metadata of the message, or of the artifact when the statement is the result of a task.
In the life of a task. Between agents, work travels as an A2A task. A task moves through states, each with an optional status message, and its finished outputs come back as artifacts. Several rules already have a natural place in that life, so the Commons uses the states the protocol has instead of inventing its own:
The reason travels in the status message that accompanies the state. Inside one agent the same pause reaches the person through the host's own way of asking (section 9); between agents it travels as the state of the task. Either way the action waits. A task in the completed state is finished in the protocol's sense; section 8 says when it is done for a person.
§ 8
The shared vocabulary and its bridges
Agreeing on one dictionary for everyone does not work. The commons keeps a small register of bridges, seeded with consent, decision, done, data about me and resident. Take consent:
Resident“I agreed to this, and I can take it back”
Citya lawful basis recorded in a file
Businessa ticked box in the terms
Bridge: consent counts only if it is specific, recorded and revocable by the person at any time.
The word done is also where protocols and people part. An A2A task marked completed is done in the business sense of this table: the ticket is closed. For a person it is done only when the bridge holds: they confirm the result, or the report links to evidence.
§ 9
The commons as data, and a server for agents that want one
The rules, the red lines, the vocabulary and the dossier template are published first as versioned files that an agent loads and checks against locally. This is the normative form. An MCP server is one implementation that anyone may host.
Version 0, read and check only. The prompt civic_rules returns the ten rules with the version and content hash of the files they were built from. The tools:
check_actionfind_bridgelist_affected
allowednot allowedunknown
Version 1, tools that write, each behind the person's explicit consent:
log_eventreport_incidentsubmit_view
The split follows MCP's own design. In MCP, prompts are meant to be chosen by the user, resources are supplied by the host application, and tools are called by the model. These are the three holders of section 4: the principal loads the rules as a prompt, the runtime reads the commons as resources, and the model asks check_action as a tool. The rules come as a prompt so that a person chooses to load them; no server slips them into a model on its own.
Unknown means stop. When the request came from another agent, the task waits for input (section 7). The check is local or stateless, so no central point sees what every agent in a city intends, and the commons never holds the logs.
§ 10
How the pieces fit
- A2Ahow agents find each other, hand over tasks, report their state and return results
- MCPhow an agent connects to tools and data
- Layer 3what a system is, who owns it, what risk it carries, what evidence backs it
- Civic Agent Commonshow an agent behaves, what its messages mean, what it may do
Above them sit the Living City AI Commitments and the Lichtensteig AI Declaration, what we all believe, in one short text.
§ 11
Conformance
- Declared: the agent publishes its card and loads the rules, and its provider states which duties its runtime holds.
- Assessed: a competent reviewer has run the tests against the agent and a second, independent agent, and published the results.
- Verified: an independent reviewer has tried to make the agent break its mandate and the red lines, including through hidden instructions, and it held.
Conformance belongs to an agent version in a deployment, never to a provider, and it expires.
§ 12
First implementations
- A team of three, now.Lev Gordon, Pavel Luksha and Alexander Maneev each work with their own agent on these very documents. The agents collect proposals and do not edit the shared text.
- The summit companion,from November 2026: every participant's agent explains the Declaration and, with consent, passes their view on.
- Lichtensteig,if the town agrees.
§ 13
Open questions
- How to prove an agent's identity across providers without a central authority.
- How a guardian agent gets and loses its mandate.
- What a child's agent may and may not do.
- Who is liable when an agent acts within its mandate and still causes harm.
- What “unknown means stop” means when time is short.
- Who hosts the shared vocabulary, the data files and the reference server after the summit.
- How agents pay each other, if they ever should. The Agent Payments Protocol (AP2) now extends A2A to payments; what the Commons would add to it, such as mandate limits, consent and the log, is open.
These questions are open to anyone who builds agents. See the invitation below.
Annex A
How the Commons sits on existing protocols
The governance of A2A, its task lifecycle and the merger of ACP into A2A rechecked on 27 October 2026.
