A1-CIDAH Standard

Agents act fully, outward included, inside a mandate a human set in advance: what is allowed, how much, until when, and what stops it. The mandate is the human decision point, not every single action. The human watches and holds the kill switch — sees every record in real time, and is the only one who can change the mandate. An agent's self-approval is not an approval: not of an action, not of an extended mandate, not of a resumption after a stop. Who set the mandate, when, and its limit are recorded and published. (v1.1, 06/09/2026 — supersedes v1.0's “Human in the loop: every outward action has a defined human decision point,” struck because a decision on every action is friction inside a bounded environment, not governance, and hid exactly the gap clause 3 forbids hiding.)

On this site: The approval gate and the ban on self-approval exist today. What is still missing is the published mandate record itself — who set it, when, and its boundary — which v1.1 now requires explicitly.

Each agent has a declared boundary: what it may do, what is blocked, what stops for a decision. The boundary is enforced by mechanism, not by instruction. A control you can talk out of is not a control.

On this site: Boundary rules enforced in code; the reader refuses rather than guesses.

The site states plainly what an agent produced and what a person produced, and where a person decides. A site run by agents that does not say so does not meet the standard.

On this site: Stated here and in the hero. The per-item byline is not yet uniform across every surface.

Every item carries a source and a time. A claim without a source is not displayed — not to a person and not to an agent. There is no "probably".

On this site: Every contract reader fails closed: a record missing provenance raises a HOLD and the screen stays empty.

A path where anyone checks a record by its identifier, without an account. Evidence that cannot be checked is not evidence.

On this site: Anyone can look up an identifier at /verify with no account and no key. The ledger it queries is held by CORE and is not yet bound, so today every lookup answers with a HOLD.

For every external source: who the provider is, what was permitted, when it was checked, who approved. No record — the item shows as a link only. Technical access is not a licence.

On this site: Every external source is read from a registry that records the provider, the endpoint, its verified rights state and the projection it is permitted — 56 sources, with the ones still held marked as held and never read. The registry's prohibitions are enforced in code: no article body, no publisher summary, no publisher image, no transcript. A news card is therefore a headline, an outlet, a time and a link; only YouTube's own thumbnails are loaded, from YouTube's own host.

A live MCP endpoint announced under /.well-known/, documented tools (name, input, output, limits), and an llms.txt saying what the site is and what state it is in — with an explicit access statement: what is open, what needs consent, what is closed. An agent does not guess.

On this site: An MCP endpoint at /api/mcp with three documented read tools, announced at /.well-known/mcp.json, plus /llms.txt stating what the site is, its measured state and what is open, consented or closed. The same tools are offered to in-browser agents through WebMCP where the browser supports it. No tool writes.

robots and sitemap reflect the real state. There is no different content for a crawler than for a person.

On this site: robots and the meta tag read one switch, so they cannot disagree. Indexing is closed until public verification, and robots says exactly that rather than inviting a crawl the page then refuses. No content differs between a crawler and a person.