PGRIP · The P in WRAP
GRIP is Foxora's protocol: the written rules for agent work.
It writes down who asked for a job, how far an agent may go, what it may spend, who must say yes and what counts as done. Every record is signed, so anyone can check it. Written for work on screens today, and next for agents that talk to devices.
Sheet 01 · The case for the layerA film
Two corrections. The film says a reference runtime was released with the paper. It was not: Foxora Runtime is in private preview. It also says the EU AI Act's record-keeping duties became enforceable this August; the paper gives 2 December 2027 and 2 August 2028 for high-risk systems. The transcript sets both corrections beside the lines.
Its words, and the paper's. The film uses a runtime's own names. Its intent, lease and waitpoint are the paper's Mandate, Grant and Stop, shown further down this page.
Every agent protocol built so far answers the same question: how do agents talk to each other? Model Context Protocol standardises tools. A2A standardises discovery. They’re good at plumbing, transport, capability, task lifecycle. But notice what none of them ask.
Who authorised this? Under what authority, and for how long? Within what budget? Who has to approve it? And when it’s over, what can you actually prove?
That’s not a small gap. Researchers call it a missing architectural layer. Six hundred and seventeen governance findings across six popular agent stacks. Roughly two thousand MCP servers surveyed, uniformly unauthenticated. And the EU AI Act’s event recording obligations became enforceable this August.
Correction That line is wrong. The GRIP paper gives the dates when the EU AI Act’s record-keeping rules for high-risk systems (Article 12) apply: 2 December 2027 under Annex III, and 2 August 2028 under Annex I.
GRIP is the Governed Runtime Intent Protocol. A governance contract for agentic work. Here’s what it binds into one agreement.
An intent, the unit of work, written as a contract. What must be true when this is finished. What constraints hold. What counts as proof. And a budget with four axes: input tokens, output tokens, time, and money.
Authority, as short-lived signed leases. Not a password. Permission to do one thing, for one purpose, until it expires. The root signing key lives outside the engine, so the runtime can verify authority but can never mint it for itself.
Attention, a governed queue where every refusal is typed, and carries its reason in plain language. Context, compiled deterministically, addressed by digest, with a receipt that explains what was left out, not just what went in. Execution, with effect boundaries, so a retry cannot fire the same real-world action twice. Settlement, evidence, checked criterion by criterion, signed. The state machine itself refuses to close an intent without proof.
And waitpoints, human approval as proof of possession: the engine holds only the digest of your approval token. It is structurally incapable of approving on your behalf. Every gate decision lands in a digest-chained ledger. Which makes a GRIP runtime two things at once: auditable, for compliance, and trainable against.
MCP and A2A describe what an agent can do. GRIP contracts what it may do, what it owes, and what it can prove. The protocol is specified as typed messages, and implemented in a reference runtime released together with the paper. This is GRIP’s debut.
Correction The runtime was not released with the paper. Foxora Runtime is in private preview. What came out with the paper is the specification and its files: the schemas, the registries, a verifier and seven test vectors.
The figures the film gives about other systems come from research the paper cites.
PGRIP · 1 of 6 · Why the rules travel
Most safety checks look at one action at a time: is this call allowed? A real job runs for hours or days. It passes between agents, spends its budget bit by bit, and needs a person's yes at the right step.
So GRIP writes the rules down once, signs them and sends them along with the work. Afterwards, someone who wasn't watching can check the whole job.
Beside the protocols you may know
GRIP works beside them. It does not replace them.
One callChecked in an instant
One job · hours or days · six kinds of signed record
PGRIP · 2 of 6 · What it writes down
Every GRIP job is a chain of signed records, from the agreement that opens it to the check that closes it. Before a model acts, GRIP writes down exactly what it read, and marks which parts may give orders. Here is the paper's own worked example: a support bot handling a customer's refund.
Sheet 02 · The worked chainFrom the paper · GRIP 1.0-draft.2 · §4.3
Resolve open billing tickets, with refunds under USD 50 each.
Dana signs the job
SignedThe support bot may work in the CRM for one hour.
Choose the next step for ticket batch 7.
3,112 of 4,000 tokens read
Every act leaves one. A refusal says why, in a reason software can read.
Refused
A USD 42 refund on ticket 8812.
Dana approves
ApprovedSettled
The totals are worked out again from the receipts, and they match. A rewritten summary would not.
Lee took no part in the work
Each record carries the fingerprint of the ones before it. Take one out or change a word, and the chain no longer checks.
PGRIP · 3 of 6 · The human gate
When an act would change something in the world, like moving money, GRIP holds it until a named person decides. The approval names that exact act, and it works once.
Sheet 03 · The Stop, in three beatsFrom the paper's worked chain
Refused
A
The bot asks to post a USD 42 refund. A refund moves money, so it needs a person's yes. There isn't one yet, so the gate says no and writes down why.
Refund USD 42 · ticket 8812
B
GRIP raises a Stop that names this exact refund, and Dana as the one who decides. She signs with her own key. The system has no key to sign for her.
Allowed once
C
The refund comes back pointing at Dana's signed Stop, and goes through. The Stop is now used up. Try it a second time, and the check fails.
Live in Foxora Studio The same habit, in the product you can use today: agents ask before going past your brief, and wait for your yes.
See StudioPGRIP · 4 of 6 · Where it stands
GRIP is a draft. The design is decided and written down in full, and it is published so people can read it and argue with it.
It is not something you can switch on today, and no one outside Foxora has built it yet. It can still change.
PGRIP · 5 of 6 · Read it
The specification, its files and the paper are public. Read them, check the worked examples, and tell us where they are wrong.
How to cite
Cite the DOI, not this page.
A DOI always points to the published record, even if a file moves.
GRIP · 2026 · preprintIndex card
Parashar, M. D., & Parashar, A. (2026). GRIP: The Governed Runtime Intent Protocol (Version 1.0-draft.2) [Preprint]. Zenodo. https://doi.org/10.5281/ zenodo.22078457
PGRIP · 6 of 6 · Licensing
Anyone can read GRIP, cite it and tell us what they think. If you plan to build GRIP into a product or a service, talk to us about a licence.
Tell us what you are building, and we will talk it through with you.
GRIP is a draft to read. Foxora Studio is live today: agents ask before going past your brief, stop at your budget, and nothing is done until you accept it.
