PIC Standard: Provenance & Intent Contracts

Local-first action gating for AI agents. Verify intent, provenance, and evidence before any high-impact tool call executes.

Contributors wanted. External contributors have already landed conformance vectors, CLI JSON output and Windows CI, and we are looking for more contributors and co-maintainers. Start with the call for contributors and the pinned good-first issues: small documentation tasks, each with the exact commands to check your work. TypeScript has a public implementation at pic-standard-ts; Go and Rust implementations and TypeScript evidence mode are planning tracks open to expressions of interest.

v0.9.1 (2026-10-14): Integration surface and a security-hardening fix. Adds structured JSON output to pic-cli verify, an optional, additive MCP guard pre-execution hook (on_allow), and live-argument binding: the MCP guard and HTTP bridge now bind the sanitized live tool arguments to the verified action.args and fail closed with the new PIC_ARG_BINDING_MISMATCH error code, completing tool binding (tool name and arguments) at that boundary. The PIC/1.0 wire format, PIC-CJSON/1.0, and proposal and evidence JSON schemas are unchanged from v0.9.0; the HTTP bridge error-code enum expands additively, and the conformance corpus grows from 84 to 91 vectors. See CHANGELOG for the full v0.9.1 story.

Evaluating PIC for an agent workflow? Start with the agent integration guide: choose an implementation, check signed evidence locally, see a complete signed-approval example, and understand what the execution boundary must enforce.

PIC is a lightweight, local-first protocol that forces AI agents to prove every important action before it happens. Agents must declare intent, impact, provenance, and evidence; PIC verifies everything and fails closed if anything is wrong.

PIC is not agent identity or delegation infrastructure; PIC is the action-bound verification contract that decides whether a high-impact tool call is justified to execute now.

No more hallucinations turning into wire transfers. No more prompt injections triggering data exports.

Example — when PIC blocks: A Slack message asks an LLM agent to send a $500 payment. PIC requires the agent to prove: where did this instruction come from? Is the source trusted? Is there evidence the invoice is real? The Slack message carries no trusted provenance, the claim has no backing evidence — PIC returns block. The payment tool never executes.

---

Table of Contents

• Why PIC?
• Quickstart
• The PIC Contract
• How It Works
• Evidence Verification
• Keyring (Trusted Signers)
• Implementations
• Integrations
• RFC & Prior Art
• Roadmap
• Project info
• Contributing

---

Why PIC?

Guardrails constrain what the model says. PIC constrains what the agent is allowed to do based on verifiable provenance + evidence.

PIC is built for agent frameworks, internal tool gateways, and production systems where high-impact actions must be justified before execution.