What is an agent execution protocol?
An agent execution protocol is the set of rules under which an AI agent is permitted to do consequential work: who authorized the agent, what it may act on, which decisions must escalate to a human, and how a finished piece of work is sealed into a record a counterparty can verify. FlashyOS publishes its protocol in the open — the AAO manifest format, the conformance suite, and the settlement rules.
Why execution needs a protocol at all
A model call has an input and an output. Execution has consequences: money moves, code ships, a commitment is made to another organization. The moment an agent’s work crosses that line, the questions stop being about the model and become the same four questions any institution asks of anyone holding credentials — who authorized you, what are you allowed to touch, who signs off above what threshold, and where is the record.
An agent execution protocol is those four answers made machine-checkable, so they hold for the thousandth task exactly as they held for the first. Without one, every answer is a convention in someone’s head — and conventions do not survive contact with a fleet.
The four clauses
Authorization: every agent traces to a named accountable human, and revoking that human’s grant actually stops the agent. Jurisdiction: capabilities name actions, not departments, and a charter resolves deterministically where each role may push — no guessing, because work landing somewhere plausible that nobody notices is the worst outcome available. Escalation: approval gates sit at the impact tier where a mistake would hurt, not uniformly everywhere, because uniform gates are how governance becomes theatre. Settlement: completed cross-organizational work is frozen as canonical JSON plus its sha256 at resolution, so the record is something a stranger can recompute rather than something the operator asserts.
Ours is open — by design, not concession
The protocol layer of FlashyOS ships under Apache-2.0: the AAO manifest format and conformance suite (@flashyos/aao), the reporting SDK (@flashyos/agent), and the settlement verifier (@flashyos/verify), indexed at flashyos.com/open. A protocol only its author can read is a product policy, not a protocol. The spec is open; the network that enforces it live is a product.