Agentic AI frameworks define how agents behave, what tools they call, and how they are authenticated. None of them formally specify the entity the agent is acting for. ProxySkill defines that standard.
Trusted delegation requires more than safe code and a well-behaved agent. It requires a complete principal specification — a structured declaration of who is being represented, what they are authorized to do, what they are trying to become, and where the boundaries of autonomous action lie.
— The ProxySkill Thesis
The Principal Gap
Current agentic AI security and identity frameworks are agent-centric. They ask who the agent is, what it can access, and how its actions are audited. These are necessary questions. They are not sufficient ones.
Delegation is not a technical act. It is a representational act. When an agent acts on behalf of a person or organization, it is not merely executing within permissions — it is acting as that entity in the world.
The question being asked
"Is this agent authorized to do this?"
The question that matters
"Should this agent do this, on behalf of this principal?"
These are different questions. Answering the second requires knowing who the principal is — their identity, their current context, their trajectory, their expectations of representation, and their categorical boundaries. No current standard provides a framework for encoding this information in a portable, interoperable way.
Principal Specification
A complete principal specification gives an agent what it needs to act faithfully — not just within technical permissions, but within the intent, values, trajectory, and boundaries of the entity it represents.
01 — Identity
Who the principal is
Values, worldview, decision-making style. For organizations: mission, culture, brand voice, non-negotiables.
02 — Context
Where they are now
Current role, relationships, constraints, and pressures. The live situation the agent is acting within.
03 — Trajectory
Where they are going
Vision, goals, strategic direction. The layer that makes priorities coherent and separates aligned action from drift.
04 — Authorization
What the agent may do
Behavioral authorization — distinct from technical permissions. Autonomous, confirm, or never. What the agent should do with the access it has.
05 — Expectations
How to represent them
What the principal requires of any agent acting on their behalf. Representation standards that travel across all runtimes.
06 — Boundaries
What is never permitted
Categorical prohibitions that cannot be overridden by any skill, prompt, or external instruction. Permanent until explicitly revised by the principal.
Principal Types
Agents act on behalf of individuals, teams, and organizations. Each principal type has different identity characteristics, different authorization structures, and different governance requirements. The PRINCIPAL.md standard addresses all three.
The Person
A single human with personal values, goals, life constraints, and a trajectory. The agent serves this person's long-term interests, not just their immediate instructions.
The Team
A group with collective objectives, role-based authorization, and distributed authority. Who speaks for the group? Who can update the spec? These questions must be explicitly answered.
The Institution
A company or institution with mission, policy, compliance requirements, and governance structures. The highest-stakes principal type, and the least well-served by current frameworks.
The File Format
A structured Markdown file with YAML frontmatter — portable, human-readable, version-controlled, and runtime-agnostic. Not a config file. A specification of who the agent is acting for, built by the agent through structured conversation and owned by the principal.
principal_type
Declares individual, workgroup, or organization. Governs which sections are required.
spec_maturity
How complete and developed this specification is. A property of the file — distinct from agent trust tier, which is an agent-side concern.
authored_by
agent, human, or hybrid. The spec should be constructed by an agent through a structured bootstrap interview, then reviewed and approved by the principal.
Write-protected
An agent may recommend updates to PRINCIPAL.md but cannot write to it unilaterally. An agent that can silently rewrite its principal specification can rewrite its own constraints.
Versioned
Follows semantic versioning. Agents note the version they were calibrated against and flag when the spec has been updated.
Standards Process
ProxySkill submitted a public comment to the NIST NCCoE AI Agent Identity and Authorization Concept Paper (March 2026), proposing principal specification as a required artifact in interoperable agent standards. The comment recommends that NIST explicitly develop a specification standard for the Actor layer identified in their own architecture diagram — the entity that initiates agent flows and receives results, but is currently left unspecified.
The Specification
Select a principal type to explore which layers are required and how each one applies. Click any layer to expand the full specification.
Frontmatter preview
Project Status
PRINCIPAL.md is a draft v0.1 specification. It is being developed in public, deliberately early. The window for establishing foundational standards in agentic AI is narrow. ProxySkill is planting a flag.
Spec Version
v0.1
Draft · March 2026
NIST Comment
Submitted
March 2026
License
Open
CC BY 4.0
GitHub
Coming
April 2026
ProxySkill is looking for practitioners, runtime developers, and standards contributors who see the same gap. If you're building agentic systems and thinking about the principal layer, reach out.
dmccleld@gmail.com