Agents can act. Nobody standardised who says yes.

Every serious agent platform agrees: before an agent spends money, posts publicly, or touches a customer, a human should sign off. But each platform invents its own private way of asking — the pause, the ping, the approval, the audit log, all locked inside one vendor's SDK.

The ecosystem standardised two conversations. The third one was missing.

Twenty seconds on why this exists.

Small enough to read over coffee. Sharp enough to audit against.

Two-person control, built in.

The most sensitive actions shouldn't rest on a single click. An Intent can require quorum — M distinct approvers must each countersign before the action is authorized.

An agent wants to post. You hold the pen.

Left: the Intent the agent emits. Right: what lands in your Telegram. Approve it, reject it, or ignore it and watch the Default fire.

{
  "countersign": "0.2",
  "intent_id": "3f0a…e921",
  "action": "linkedin.post.create",
  "summary": "Publish Q3 campaign post
             for Acme Bank",
  "risk_tier": "high",
  "approvers": ["telegram:cmo"],
  "quorum": 1,
  "timeout": 900,
  "default": "reject"
}   // signed by the agent key ↓
sig ed25519:7bc1…e94a

An approval that evaporates after the if is worth nothing in an audit.

A Countersignature is ed25519-signed, names the actor and the policy, pins the exact intent, and verifies offline — no callback to the issuer, no trust in the system that stored it.

const head = await receiptLog.head();  // anchor { length, hash } out of band
const report = await receiptLog.verifyAll({ trustedKeys: [AUTHORITY_PUBLIC_KEY], expectedHead: head });
// { total, valid, ok, faults: [...], chain: { intact, brokenAt?, reason? } }
// ok === true  ⇢  every receipt is genuine AND the log is intact against your anchor.

Reach the approver where they already are.

One Adapter interface: deliver the Intent, hand back the decision. Push where the channel supports it, poll where it doesn't. What the approver sees is derived from the signed envelope — an adapter never alters or re-signs it.

The guarantees are in the signatures, not the servers.

Gate any function behind a human, in about five lines.

import { wrapAction, ReceiptLog } from "@countersignlabs/counter-sign";
import { TelegramAdapter } from "@countersignlabs/counter-sign/adapters/telegram";

const deploy = wrapAction(deployProd,
  { action: "deploy.prod", summary: "Deploy v2.1.0 to production",
    risk_tier: "high", approvers: ["telegram:8675309"],
    timeout: 300, default: "reject" },
  new TelegramAdapter(),
  { receiptLog: new ReceiptLog("./receipts.jsonl") });

await deploy("v2.1.0"); // runs only once a human countersigns; every decision is logged

Built to be everyone's. Authored by someone.

Code license

Apache-2.0

Schemas, adapters, and the shim — patent grant included, so enterprise counsel can relax.

Spec license

CC BY 4.0

The specification text may be republished and translated freely with attribution. Standards spread by being quotable.

Stewardship

Authored, sponsored

Spec author Haridarman Kumaresan; sponsored by Agentsstack Pte. Ltd. Anyone can implement the protocol; CLAIRE is the first reference deployment. Filed as an IETF Internet-Draft ↗.

Sponsored by

Category

Agent Accountability Rails

counter-sign is the first proposed component of a broader category — Agent Accountability Rails (AAR): cryptographic, human-named, mandate-scoped accountability infrastructure for autonomous agents. Other rails address credential-issuance lifecycle, delegated-mandate transport, and provider-side receipt verification. No single vendor should own the category.