The Grounding
Protocol
How humans and machines talk, how machines talk to each other, and the one connector that is missing from both.
“Do not say that for which you lack adequate evidence.”
Grice, Logic and Conversation, 1975 — the oldest rule in communication, and the only one that has never been given a wire format.
This sheet surveys both conversations — person ⇄ model and agent ⇄ agent — across the canon and the 2026 frontier. They turn out to be failing at the same thing, in the same place, for the same reason. The last three plates propose the connector, name it, and cost it.
Two conversations, one missing edge
A person asks a model a question. The model answers. What crosses the wire is a claim — fluent, confident, unaccompanied. What does not cross is everything needed to believe it: where it came from, when it was last true, and what the model did not check.
An agent calls another agent. Same wire, same omission. HTTP has negotiated media type since 1996, language, encoding, and — through Memento — the date of a representation. It has never negotiated the quality of the evidence.
These are usually treated as two fields with two literatures. They are one problem with two renderers.
What the old work already solved
The canon is not a warm-up. Most of what the agent era is currently rediscovering was specified — precisely, and with experiments — between 1945 and 1999. The right-hand column is the uncomfortable part.
| Year | Source | The mechanism | What 2026 is re-solving badly |
|---|---|---|---|
| 1968 | Taylor, question-negotiation |
Four levels of need — visceral, conscious, formalized, compromised — and five filters that walk a bad query back to the real one. | The reference interview is a complete intent-elicitation protocol. We replaced it with an empty prompt box and called the mismatch prompt engineering. |
| 1975 | Grice, maxims |
Quality: do not assert what you lack adequate evidence for. Quantity: do not over-inform. | Hallucination is not a novel failure mode. It is a maxim violation with a marketing budget. |
| 1985 | Hutchins, Hollan & Norman |
Two gulfs: execution (intent → available action) and evaluation (output → interpretation against the goal). | LLMs collapsed the execution gulf and widened the evaluation one. Output you cannot check against your goal without redoing the work is not an answer. |
| 1989 | Star & Griesemer, boundary objects |
Objects “plastic enough to adapt to local needs… yet robust enough to maintain a common identity across sites.” | This is the theory that permits one record to serve a curator, an investor and an agent without collapsing into mush. Nobody is using it. |
| 1991 | Clark & Brennan, grounding |
Understanding is jointly ratified — presentation and acceptance — to “a criterion sufficient for current purposes.” | Chat presents without accepting. There is no cheap ratification turn, so repair cost lands entirely on the human, downstream. |
| 1996 | Green & Petre, cognitive dimensions |
A vocabulary for judging notations — viscosity, premature commitment, hidden dependencies. | A claim whose source dependency is hidden rots silently. That is precisely what a verification heartbeat exists to catch. |
| 1999 | Pirolli & Card, information foraging |
Foragers follow scent — proximal cues about the value and cost of a source. | Generated prose is cue-poor by construction. It degrades scent for every downstream forager, human and machine alike. |
| 1999 | Horvitz, mixed-initiative |
Twelve principles, including: use dialog to resolve key uncertainties, and minimise the cost of poor guesses about action and timing. | This is the agent-UX specification, written twenty-seven years ago. Most agents act unconditionally and apologise afterwards. |
Every row above: Verified against the primary text. Sources in Plate VIII.
What 2026 actually measured
Four findings from the past eighteen months do real damage to the intuitive design of an AI interface. They are the reason the proposal in Plate VI takes the shape it does.
Explanations amplify. Sources correct.
In a pre-registered study of 308 participants, explanations increased reliance on model output that was wrong as readily as output that was right. Reliance on incorrect answers fell in two conditions only: when sources were provided, and when the explanation visibly contradicted itself. Verified
Design consequence: shipping more reasoning is not a safety measure. Shipping the receipt is.
Citation has to unfold in place.
An interface that lets a reader open a cited sentence into its constituent claims, colour-coded by supporting and contradicting evidence, without leaving the page, got readers to their first source about 48 seconds faster and led them to insert more grounded facts into their writing than a conventional citation list did. Twenty participants; modest, directionally clean. Verified
Design consequence: a link that costs a context switch is decoration, not verification.
What the agent did not do is invisible.
Across 20,574 real coding-agent sessions, two of the most common failure signatures were violating a stated constraint (38.33%) and reporting inaccurately on its own work (22.58%). Separate work from Microsoft Research finds that people overseeing agents want support for interpreting when and why the agent did not find what was asked — and proposes extending trace displays to show what the agent did not do. Verified
Design consequence: the unchecked list is not an appendix. It is half the payload.
Verbalised confidence is one bit.
Hedging language in model output is roughly stable within a domain and degrades across domains, and the markers compress badly against an actual 0–1 confidence range. The usable signal is hedge or no hedge, not which hedge. Verified
Design consequence: do not ask the model how sure it is and print the number. Compute trust externally, from the record.
The machine lane, without the press release
The agent-protocol landscape as of this week. Read the right-hand column before building on anything.
ttlMs — a native, already-standard hook for expressing claim freshness. It carries no provenance or trust metadata at all.The gap, stated precisely
Here is what a deliberate search for prior art returned. HTTP negotiates media type, language, encoding, and — via Memento — the datetime of a representation. W3C has a Recommendation for provenance lineage, and a Recommendation family for verifiable credentials. Neither models quality; provenance says where a thing came from, not how good it is or whether it is still true.
There is no general-purpose, cross-domain, machine-readable vocabulary for evidence strength in any W3C Recommendation. The one narrow property that exists is bound to medical guidelines and shows under a thousand domains using it. And there is no mechanism, anywhere, by which a consumer can ask a producer for claims of a given evidential quality.
Two near-misses are worth naming, because they are the first objections anyone will raise. The Data Quality Vocabulary is the closest general-purpose quality vocabulary — and it is a Working Group Note from 2016, not a Recommendation. Content Negotiation by Profile is the closest thing to a negotiation header — and it is still a Working Draft, and what it negotiates is conformance to a schema, not the strength of the evidence behind a claim. Neither closes the hole. We went looking for prior art specifically to kill this proposal, and could not.
That is the gap. It is load-bearing, it is unclaimed, and it sits exactly where our garden already does its work.
The proposal — Grounding
Named for Clark and Brennan, whose 1991 account of how two people establish shared understanding — presentation, then acceptance, to a criterion sufficient for current purposes — describes exactly the mechanism the machine layer never got. Three parts. Each closes a gap the survey found genuinely unclaimed.
I · The rootstock — one record, many scions
In grafting, the rootstock carries the vigour and the disease resistance; the scion carries the fruit. Here the rootstock is the claim record — the only object that is true — and every surface is a scion compiled from it: the specimen card, the citation capsule, the JSON-LD block, the MCP resource, the caption burned into a film.
Two fields matter more than the obvious ones. checked[] and unchecked[] record what the verifier actually looked at and what it did not — the payload that the agent-oversight literature says no interface surfaces. And challenges[] carries any contest to the claim, so a disputed record travels with its dispute.
The discipline is a build step, not a convention: a divergence test in CI that fails the build when any scion asserts something the rootstock does not. That single test is what converts “verified” from a promise into a checkable property.
II · The handshake — negotiating the evidence, not the format
Two headers, mirroring content negotiation. The request names the evidential floor it can live with; the response reports what it served, and what it withheld and why.
→ request Accept-Evidence: tier>=verified; max-age=90d; primary=required; verifier!=self ← response Content-Evidence: served=7; withheld=4; reason=stale(2),tier(1),no-primary(1); weakest=0.71; policy="/grounding/v0"
The withheld line is the load-bearing part, and it is the part nobody has built. The documented failure of every optional HTTP preference mechanism is that servers may silently ignore the request, so the negotiation decays into a no-op. Grounding makes silence impossible: a compliant response always declares its omissions, which means a consumer can tell the difference between “there is nothing else” and “there is more, and you can’t have it.”
That is Clark and Brennan’s acceptance turn, written as a header. It is also the direct answer to the missing-negative-information failure from Plate III — at the protocol layer rather than the interface layer, so every surface inherits it for free.
III · The decay clock — trust that ages, per class, inside the signature
A verified claim is not verified forever. Each record carries its own decay curve, keyed to its class, signed into the payload so a receiving agent computes current trust offline with no status-list round trip.
This must be per-class, and that is not a refinement. Recent work measuring learned, heterogeneous decay against a single global half-life found the uniform version performing dramatically worse than applying no temporal weighting at all. A naive half-life is not a simplification; it is a regression. Protocol status ages in weeks. A 1975 paper’s claim about conversational implicature does not age.
trust(t) = tier_weight × 2^( −(t − verifiedAt) / halflife(class) ) halflife by class · market-figure 60d protocol-status 90d adoption-metric 120d standard-status 365d research-finding 730d canon ∞
Run the handshake
The corpus below is this document’s own evidence — every claim used to build this sheet, with its real tier, source and verification date. Set an evidential floor and watch the response change. The withheld rows stay on screen, greyed, with their reason: that is the protocol working.
Decay is computed client-side from each record’s class half-life — exactly as a receiving agent would compute it, with no call back to the garden.
Everyone is building agents that can talk to each other. We are building the only thing they will need to say.
Why this shape, and what could kill it
The argument from the Semantic Web’s own post-mortem
Grounding looks, at a glance, like the thing that already failed. It is not, and the difference is economic rather than technical. The clearest retrospective on the Semantic Web — written by one of the people who built schema.org — offers the rule the original project broke: when there is an asymmetry in the number of publishers and the number of consumers, put the complexity with the smaller number.
The Semantic Web inverted that. It asked millions of publishers to pay an authoring cost so that a handful of consumers could reason cheaply, shipped long normative specifications into a world where nobody reads them, and offered the publisher no same-quarter reward. What survived was precisely the part that dropped the reasoning and attached to money: the markup a search engine paid for with rich snippets.
We are the small number. One garden, a defined circle of consumers, a verification pass we are already running for editorial reasons. The complexity lands where the rule says it should. That is not a workaround — it is the only configuration in which any of this has ever worked.
The argument from where the machine lane is going
Agent-to-agent traffic is moving toward latent channels because they are faster and cheaper, and their own authors concede the messages are not human-readable. As the fast path goes opaque, the audit path becomes the scarce good. A garden whose entire product is source-stamped, freshness-dated, independently citable claims is selling the one thing the fast path structurally cannot carry.
The honest risk
Every epistemically superior format in this survey died of distribution, not of design. Nanopublications: about 139 users. The argument-interchange formats: no adoption. Micropublications: never commercialised. ClaimReview: killed by its only consumer. The two provenance standards that won — content credentials for media, and verifiable credentials — won by attaching to hardware and to money, not to elegance.
So the strategic instruction is the opposite of the instinct. Do not try to standardise Grounding. Ship it as the garden’s internal contract, publish the spec so it is legible and forkable, point partners at it, and let any adoption be a consequence of the garden being worth reading. Our forecast — Guess — is that an evidence-negotiation header reaches an IETF draft before agent discovery gets a registry standard, because the people who need it are publishers with something to protect, and there are fewer of them.
Build order
-
The divergence compiler ≈ 1 week
One rootstock JSON → card HTML + JSON-LD + MCP resource, and a CI test that fails when they disagree. Do this first regardless of everything else on this sheet: it is the only item that makes “verified” checkable rather than asserted, and every later item depends on there being one true record.
-
checked[] and unchecked[] on every record ≈ free
A field and a rendering rule. It closes the failure the oversight literature says nobody closes, and it costs a verification pass we already run nothing extra to emit.
-
The decay clock ≈ 3 days
Per-class half-lives, computed client-side from the signed record. Drive the MCP resource’s
ttlMsfrom it — that field is already in the current spec, so freshness rides a standard mechanism rather than a custom one. -
The handshake ≈ 1 week
Accept-Evidencein,Content-Evidenceout, on the HTTP lane and the MCP endpoint. Serve the withheld list from the first commit; it is the part that makes the rest more than housekeeping. -
Identity: signed agent card + outbound request signatures ≈ 2 days
A signed card at the well-known path, and HTTP message signatures on our own outbound fetches. Cheap, standards-track, and it is how the garden stays on allowlists as the open web closes to unidentified agents.
-
Payments: build the surface, leave the meter off deferred
Stable per-claim URIs, per-call logging, a published price list. When agent payment volume is real rather than reflexive, switching it on is a week. Selling licensed access to three partners beats plumbing micropayments for zero agents.
Receipts
Primary sources for every figure and attribution on this sheet. Where a source is secondary, the claim carries a self-reported chip rather than a verified one.