Dynamic defense, activated on demand.
CAP defines who can do what, under what conditions, within what timeframe. It transforms permissions from static passes into a time-bound, evaluable trust process.
CAP is the immune system of the CIS/CAP protocol family.
- Manifest — capability declarations (what a tool exposes, with security constraints)
- Decision Queue — asynchronous HITL (human-in-the-loop) state machine
- Capability Handshake — long-term identity → short-lived operational credential
- Optional Extensions — Lease (time-bound), Expiry, Audit, Passkey, Delegation
Not declared, means it does not exist. Extensions not activated mean zero overhead.
CIS (intent semantics)
↑
CIB (transport binding)
↑
CISS (mTLS security)
↑
CAP ← You are here
| Protocol | Repository |
|---|---|
| CIS | CommonIntents/CIS |
| CIB | CommonIntents/CIB |
| CISS | CommonIntents/CISS |
Apache 2.0 — see LICENSE.