Multiple agents work your task. Each sees only what it needs.
Preview the plan, approve the action, expand the receipt.
Today's tools hand your entire context to every service in the chain. You trade privacy for convenience.
Your email, calendar, budget, browsing history — all exposed to every service, with no partitioning.
Multiple agents acted on your behalf. Which ones? What did they see? No receipts, no proof.
Agents execute before you know what they'll do. No plan to review, no scope to narrow.
You describe what you want. Agents come to you with only what they need. The output is the interface.
Before anything runs, you see which agents will act, what each one will see, and what it will return.
Each agent gets a cryptographic scope — just the data it needs, with a TTL that expires. Nothing more.
Results merge locally into one outcome block. Expand it to see who contributed and what each agent saw.
Three agents, one canvas. Each sees only what it needs. You see everything.
▶ 3 agents contributed • None saw your full context
Six guarantees that hold whether your agents use AI or not.
Agents return Schema.org JSON-LD. Papillon dispatches to a two-tier renderer — agent-scoped first, then type-global, then generic fallback. 20+ registered types produce rich views: flight cards, hotel blocks, search results, answer text. All values rendered as text only. Never innerHTML.
Every interaction is stored as a receipt-anchored episode — outcome, scope exercised, disclosure refs, duration. Never raw values. After 5+ episodes, Papillon scores each agent: 35% success rate (EMA α=0.2) + 35% quality + 20% preference + 10% keyword match. The canvas improves with use.
The pap:// scheme is a contract. Every protocol link requires your explicit confirmation before dispatch — no background requests, no silent handshakes. You describe what you want. The canvas resolves which agents can do it. Your intent shapes the Internet, not the other way around.
Before any agent executes, ghost blocks preview the full plan — which agent, what it will see, what it will return. The canvas enters AwaitingApproval state with a skeleton preview of the output. No mandate is created, no data is disclosed, until you press Approve.
Two layers: the Surface shows synthesized outcomes — readable answers to your actual question, composed on-device. The Provenance layer is always one click away — each agent block, mandate scope, timing, and co-signed receipt. One canvas, many agents, your rules.
Mandates with payment scope carry blind-signed ecash tokens (RFC 9474 RSABSSA-SHA384-PSS). The mint signs a blinded message; the client unblinds it. The mint cannot link its signing operation to redemption — unlinkability is a cryptographic invariant, not a policy. Amounts, destinations, and routing data never appear in the mandate.
Agents come to you and get only what they need.
Each agent gets exactly the data it needs, with a TTL that expires. Nothing more.
"3 agents contributed. None saw your full context." Privacy you can see, not just a policy.
Results merge locally. The synthesizer never makes a network call. Your data stays yours.
See the plan before it runs. Know what each agent will do and see before you approve.