Robin Martherus
@martherusTamed Autonomy, the SHOULD layer above KTP, eleven proposals for v3.0.0, and a public Python reference library.
The stakes · Ambient Breach
Ambient Breach: when you can’t tell service from attack.
It doesn’t arrive as one event. It builds in stages.
- Ambient Risk. Dry brush. Systems are reachable, programmable and fragile.
- Ambient Threat. Sparks. The system is being probed, automated or gamed. The adversary is learning.
- Ambient Breach. Weather. You can no longer reliably tell service from attack.
- Systemic Breach. Ambiguity arrives faster than you can repair it. The debt grows.
- Legitimacy Crisis. Debt outruns the whole repair machine. It is no longer an incident.
- Ambient Breach Theory gives each stage a variable and a test.
Routine tasks hid the purpose. In 2025, human operators split an espionage campaign targeting about 30 organizations into small tasks that concealed its malicious purpose from the model. Anthropic’s report.
Friendly fire counts too. Your own agents can swamp a shared service at machine speed.
The shift · at rest and in motion
Set the boundaries. Keep them active.
You can’t always tell service from attack. KTP doesn’t have to. It asks whether the environment can carry the action now.
Governance at Rest
Governance in Motion
Define the purpose, permissions, and limits.
Check the proposed action against those limits and current conditions.
Establish consent and accountability.
Keep those obligations binding as agents delegate and act.
KTP brings live conditions into every authorization decision, while existing permissions and consent boundaries stay binding.
The mechanism
Yesterday’s permission isn’t today’s.
Conditions shift while an agent works.
- Load changes. A service under strain has less room for more work.
- Evidence ages. What was true at approval can be stale by the time the agent acts.
- Proofs last seconds. KTP checks at the moment of action with short-lived proofs. When required conditions fail, the work stops or takes its declared safe fallback.
What this changes
Capacity never overrides consent.
The payoff
Leave room to recover.
Governance at Rest
Governance in Motion
Decide which work takes priority during disruption.
Use that decision to govern what continues and what waits.
Plan recovery and name its owner.
Account for the work recovery adds and the people needed to receive it.
What this changes
Protect the repair reserve that separates Ambient Threat from Ambient Breach.
Keep essential work moving under pressure, with recovery built into the plan.
Your first step
Start with one autonomous workflow.
The Trust Infrastructure Audit maps what the work depends on, who bears its costs, what evidence backs its decisions and who owns repair.
- Record the gaps.
- Name an accountable owner.
- Choose the next test.
What you leave with
A printable worksheet with your answers, open questions, an accountable owner and a next test. Not a score.
KTP answers what the environment CAN support. Tamed Autonomy, developed by Robin Martherus, helps leaders decide which purposes SHOULD be pursued. The two fit together.
Looking for the full site? Choose a path by role.
created 26 October 2026 · last modified 2026-10-26
Questions
Common questions
Short answers about KTP, with links to the spec.
KTP is an experimental authorization protocol for autonomous systems. It ties an agent’s authority to the conditions around its next action: whether the environment CAN support the work now, within the permissions and boundaries people have set.
Zero Trust already uses context and policy to govern access. KTP explores an extension of that authorization work: whether the environment CAN support a permitted action now, with short-lived authority and explicit environmental limits. It does not replace Zero Trust or make it obsolete. Experiments must show what this adds to the controls you already operate.
- RFCKTP-Core
- SiteDefense map
- SourceNIST SP 800-207
We know of no production deployments. KTP is being explored through experiments. The specification describes requirements and intended behavior; it does not establish that a deployment is secure, effective or ready for your environment.
- RFCKTP-Conformance
- SiteLimits
At the boundary between an agent and a protected service, such as a gateway, service-mesh sidecar or application check. It governs access to actions rather than requiring a particular AI model. These are integration patterns to build and test, not a claim that ready-made connectors exist.
- RFCKTP-Enforce
- SiteArchitecture
Choose one bounded workflow. Identify its protected actions, relevant measurements, enforcement point and accountable owner. Define what happens when evidence fails or authority expires. Compare the result with your existing controls, including useful work delayed or denied.
- RFCGetting started
- SiteThe audit
The evidence depends on the workflow: service health, load, available capacity and how current the observations are, for example. Operators must document why those measurements support the decision. KTP does not automatically discover every dependency or supply a universally correct risk model.
- RFCKTP-Signals
- SiteThe Trust Score
Accountable people do. Service owners, security teams and those affected by the work need a way to establish and challenge the limits. The implementation carries those decisions into execution; it does not decide an organization’s priorities for it.
No. Capacity is a necessary check, not a grant of permission. Existing access restrictions, consent requirements and sovereignty boundaries still apply. A healthy service does not authorize an agent to do work it was never permitted to do.
- RFCKTP-Privacy
- SiteThe Soul veto
KTP specifies Trust Proofs lasting no more than ten seconds. Continuing work must renew its authority or enter a previously declared, bounded safe transition. Known changes or revoked evidence can end authority sooner. A fresh proof still needs current evidence. Expiry does not undo completed actions, and ten seconds is not a promised recovery time.
- RFCKTP-Core
- SiteIn the story
Missing or stale evidence must make the decision more restrictive; some missing inputs require denial. Incorrect readings can still allow harmful work or block useful work. Independent checks and a way to correct evidence matter. A signature proves origin and integrity, not truth.
The deployment must put enforcement on the relevant paths to the protected resource and restrict alternate access. If an agent can act through an unchecked credential or route, that work falls outside the claimed protection. Coverage has to be tested, not assumed.
- RFCKTP-Enforce
- SiteDefense map
A limit on one request does not limit the combined workload. Shared allowances for related recovery work are proposed extensions. They would need to account for what agents consume together, reserve room for essential work and be tested against the real shared dependencies.
- RFCKTP-Recovery
- SiteIn the story
- SourceJones et al., ICML 2025
Both can put pressure on the same services. An environmental restriction can apply before investigators establish intent. KTP does not replace threat detection, infer every hidden purpose or guarantee that an attack will be stopped. The goal is to constrain work where the required conditions do not hold.
Yes. Blocking a repair or interrupting the wrong operation can create additional harm. A deployment needs a defined safe transition, recovery responsibilities and tests for useful work wrongly denied. A hold is a control decision, not proof that the whole system is safe.
- RFCKTP-Emergency
- SiteIn the story
- SourceAWS, April 2011
Treat recovery as work that consumes capacity too. Existing backoff and retry limits remain useful. Proposed KTP coordination would count related repairs against a shared allowance instead of giving each helper a fresh budget. That coordination still needs implementation and validation.
- RFCKTP-Recovery
- SiteIn the story
- SourceZhou et al., 2026
A handback needs a named person or team with the authority, context and capacity to receive it. Sending an alert does not create that capacity. Proposed KTP work would hold affected recovery actions while the handback waits; people still decide priorities and own the response.
- RFCKTP-Human
- SiteIn the story
The specification contains targets, not production performance results. Measure the full path: evidence collection, proof issuance, enforcement, logging and failure handling. Include engineering effort and useful work delayed or denied, alongside request latency. There is no proven cost saving promised here.
- RFCKTP-Transport
- SiteCISO brief
The record should explain what ran, what waited, which evidence supported the decision and who owned the next step. A deployment must minimize the record and enforce declared access, purpose and retention limits. Keeping an audit trail is not permission to collect everything.
- RFCKTP-Audit
- SiteFlight recorder
CAN asks whether the environment can support an action now within declared boundaries. SHOULD asks whether its purpose is legitimate, who benefits, who bears the costs and who has standing to object. People remain accountable for both the boundaries and the purposes they authorize.
- RFCConstitution
- SiteThe Tamed Autonomy layer
- SourceTamed Autonomy
Choose one autonomous workflow and use the experimental Trust Infrastructure Audit v0.1 worksheet to examine its dependencies, evidence, costs and responsibility for repair. Record one important gap, name an owner and choose the next test. It organizes the questions; it does not certify safety or rate people.
Copies the protocol’s overview and the twenty questions. Paste it into your own assistant and let it argue with us.
Built with others
Three people have changed this protocol.
What they changed is on the public record, issue by issue. The fourth name could be yours.
Mike Storm
@gatekeeper454KIL and KAG, the two implementations at the infrastructure boundary, and the execution profile that binds one decision to one exact action.
Kimberly Osmond
@kimosmond-delInduced Conservatism: the adversary who wants denial, and uses KTP’s own fail-closed rules as the weapon.
Contribute. Every change starts as an issue on a clock: text, not code; pinned to a tag; interfaces and vectors fixed, formulas yours. The rails are short and public. Every contribution so far →
