Open Personal Context specification

Edition 1.0-draft-1 · Apache-2.0 · last changed 2026-10-15

Download the standard

Read the complete draft offline or inspect the machine-readable contracts. The edition manifest lists every file with its SHA-256 checksum, and the source file names the repository revision the site publishes.

• Complete standard (Markdown)
• Complete text and contract bundle (JSON)
• REST OpenAPI contract
• MCP tool definitions
• Core vocabulary
• Conformance manifest
• Normative statement audit
• Test vectors, whose synthetic keys must never be trusted
• Edition manifest and checksums
• Source revision
• Earlier edition: document 0.2-draft (JSON)

Reading this document

Normative language follows RFC 2119: MUST, SHOULD and MAY carry their defined meanings. Levels are written L0 to L3. Machine values, keys, scopes and paths are set in monospace. Examples are informative unless stated otherwise.

• L0CategoriesCategories only, no values
• L1PreferencesPreferences and needs, no direct identifiers
• L2NamedFirst names and household relationships
• L3IdentifiedIdentifying details

Contents

Overview

1. Open Personal Context specification

Core

1. Terminology
2. A1Scope, status and layering
3. A2Actors and trust model
4. A3Identifiers, handles and resolution
5. A4Data model
6. A5Disclosure and the compiler
7. A6Authorisation
8. A7Agent surface
9. A8Recipient API
10. A9Read receipts and the log
11. A10Revocation and purge
12. A11Portability
13. A14Contributions
14. A15Security requirements
15. A16Privacy and legal mapping
16. A17Conformance and change process
17. Design principles
18. Typed record identifiers
19. Scope grammar implementation

Reserved for 2.0

1. A12Recipient registry and trust
2. A13Emergency information
3. Continuous connectors (reserved from A14)

Bindings

1. Bindings
2. B1PDPP binding
3. B2Linked Web Storage binding
4. B3MCP binding
5. B4REST binding
6. Error registry

Vocabulary

1. Vocabulary registry

Conformance

1. Implementation and conformance status
2. Test vectors

Adoption records

1. Standards adoption register
2. AI agent memory interoperability
3. Data Privacy Vocabulary
4. Human Context Protocol
5. IAB Tech Lab Data Deletion Request Framework
6. ISO/IEC 24751
7. ISO/IEC TS 27560
8. JOSE signatures and canonical JSON
9. JSON Schema, OpenAPI and Problem Details
10. JWE and Argon2id
11. Linked Web Storage and Solid
12. Model Context Protocol
13. OAuth 2.1 and its profiles
14. PDPP Core
15. Reserved credential and health standards
16. SCITT

Worked example

1. Media worked example

History

1. Changes from the recovered proposal
2. Interpretation notes

Standards this builds on

Autonym does not define its own cryptography, authorisation or vocabularies where mature ones exist. Disclosure levels limit what is shared; signatures protect the resulting object and its bindings. The adoption register records, for each standard, the version pinned, what is taken and what is extended. This table is generated from it, and leaves out the record it marks reserved for a later version, from which edition 1.0-draft-1 takes nothing.

Related work

Several active efforts cover the layers around Open Personal Context. This section describes each one and how Open Personal Context is intended to relate to it, so that the layering and the prior art are explicit. No compatibility with any of them is certified.

PDPP and PDP-Connect

The Personal Data Portability Protocol is an open specification for how a person authorises an application's ongoing access to their personal data. It is developed by PDP-Connect, a lab at LF Decentralized Trust started by the Vana Foundation. Its draft version 0.1.0 was published for public review, and the review period closed on 1 October 2026.

PDPP is the intended first authorisation binding for Open Personal Context: the base grant, purposes, expiry and revocation would come from PDPP, and Open Personal Context would add disclosure levels, approved renderings, receipts and purge acknowledgements.

pdpp.dev

Linked Web Storage and Solid

The W3C Linked Web Storage Working Group is the standards track that grew out of Solid. It is specifying a protocol that gives applications permissioned access to data held in separate storage, and published a Working Draft of the Linked Web Storage Protocol 1.0 on 21 September 2026.

Open Personal Context treats storage as a binding. An implementation may use Linked Web Storage or Solid, another interoperable store or its own database, as long as the same disclosure and accountability behaviour holds.

Linked Web Storage Protocol 1.0

Human Context Protocol

The Human Context Protocol is a working paper and prototype from the Stanford Digital Economy Lab with Consumer Reports. It treats a person's preferences as a portable, user-governed layer that AI clients can draw on.

Open Personal Context is intended to define a mapping to the Human Context Protocol's preference semantics rather than depend on it.

Human Context Protocol working paperHuman Context Protocol project page

W3C AI Agent Memory Interoperability Community Group

A W3C Community Group, launched in June 2026, working on a vendor-neutral format for how AI agents store, share and erase information, including tamper-evident audit trails and cryptographic erasure. Community Group reports are not W3C standards.

Open Personal Context tracks this work as prior art for receipts and erasure, and is intended to align with it where the two overlap.

Community Group page

Rich authorisation requests, DPoP and pairwise identifiers

RFC 9396, OAuth 2.0 Rich Authorization Requests, lets a client ask for fine-grained authorisation in a structured form. RFC 9449 defines DPoP, which binds OAuth tokens to a key the client holds so that a stolen token cannot simply be replayed. OpenID Connect pairwise subject identifiers give each client a different identifier for the same person, which limits correlation across recipients.

Open Personal Context is intended to use these for fine-grained requests, sender-constrained access and recipient-specific identifiers rather than define equivalents.

RFC 9396RFC 9449OpenID Connect Core 1.0, section 8

Transparency receipts and deletion requests

The IETF Supply Chain Integrity, Transparency, and Trust (SCITT) working group is specifying transparency services that register signed statements and return receipts that can be verified later. The IAB Tech Lab Data Deletion Request Framework passes deletion requests along the digital advertising supply chain, with signed requests and signed confirmations of receipt.

Open Personal Context is intended to evaluate SCITT-compatible receipts for its disclosure history rather than invent new cryptography, and to reuse established deletion-request concepts, and their structures where suitable, for purge requests and acknowledgements.

SCITT working groupData Deletion Request Framework

References to other standards and projects describe intended technical alignment only and do not imply endorsement or partnership.

How to cite

Open Personal Context specification, edition 1.0-draft-1. New Media Solutions Ltd, 2026. https://autonym.dev/spec