← Back to Research

Status: implemented durable domain model, not yet exposed as a client RPC or AMP wire object. cmd/aftersmtp opens the SQLite trust store at startup; RequestService still needs an authenticated request/approve/reject API.

Principle

A communication request is not a message. It is an attributable request for a recipient-controlled delivery capability. It cannot contain a subject, text, HTML, URL, attachment, or arbitrary metadata field.

signed sender DID
       |
       v
metadata-only request -- recipient/policy rejects --> no delivery relationship
       |
       +-- recipient/policy approves --> expiring grant --> scoped AMP delivery

Request fields

The eventual AMP CommunicationRequest object MUST contain only:

  • a request ID;
  • sender DID and recipient DID;
  • a purpose from correspondence, transactional, notification, or introduction;
  • creation and expiry times; and
  • the normal sender signature / transport authentication.

Requests expire after seven days. A sender is limited to three requests per recipient per hour. Gateways must not disclose whether a rejection was manual, policy-driven, or due to an existing blocklist.

Approval

Only the requested recipient (or its authorized policy) can approve a request. Approval consumes the one-time request and creates a delivery grant which defaults to 90 days. Recipients can revoke grants at any time.

The grant records the approved purpose. Before purpose is made a mandatory, signed AMP header claim, implementations MUST treat it as audit metadata and must not claim purpose-scoped enforcement. This avoids the classic standards failure of describing a security property that the wire format cannot prove.

Bootstrap paths to test

  1. Direct request: a person requests a relationship with another person.
  2. Verified organization: an enterprise policy grants a constrained sender DID (for example a bank's statement service) to a recipient population.
  3. Introduction: a mutually trusted DID issues a limited introduction request.
  4. Imported relationship: a recipient opts to import an existing contact or authenticated customer relationship, never an inferred mailing list.

The next protocol increment should add a signed purpose claim to AMP headers and a request/decision RPC. Only then should the gateway enforce purpose-scoped delivery.