Why I am designing the Human-Agent Control Protocol
The Workplace-first Proposal gave me a way to name the durable environment around agentic work.
It makes the workplace first-class. HACP addresses a different question: how does the human explicitly invoke a consequential move inside that workplace?
A Home is one concrete workplace. Members identify the humans who belong there. Desks own their local continuity and access. Rooms own durable domains and their Material. Equipment owns reusable ways of working. Sites keep external truth. Agents participate as temporary Occupants.
That vocabulary solved one kind of ambiguity. I still needed to know which move the human had asked the system to perform.
Natural conversation works well for expressing intent. It is less reliable as the sole interface for a control that changes scope, authority, persistence or external state.
The commands are optional. A natural sentence with the same explicit scope can express the move; the stable verb makes it easier to inspect and repeat when authority matters. Praise or ordinary continuation never implies a durable transition.
The same sentence can hide different moves
Consider:
Get a researcher to look at this.
That might mean:
- add another agent as an Occupant;
- ask the current agent to adopt a researcher Role;
- activate research Equipment;
- run a predefined research workflow;
- merely answer with a more investigative tone.
These are not equivalent operations.
The workplace gives us the nouns. We still need explicit verbs when the difference matters.
call-the-researcher add an Occupant
work-as-an-engineer adopt a Role
use-research activate Equipment
The current Endroit 0.8 alpha projects these distinct
moves from first-party Equipment. Codex and Claude are L1 Projection-qualified;
provider-hosted invocation is not qualified by this release. A surface
that cannot preserve a required move must return blocked; it must not
simulate the action.
HACP
HACP is a draft semantic protocol for explicit human control of agentic systems.
A Card is a human-invoked command contract with one primary effect. A deck
distributes a coherent set of Cards. A provider command such as
$think-it-through:distill or /think-it-through:distill is one projection
of that semantic contract.
human invokes a Card
↓
provider resolves the declared contract
↓
the effect runs within existing authority
↓
the observed result becomes the next working object
HACP does not infer Cards from ordinary prose. It does not grant tool permissions, store memory, orchestrate models or own the work environment. It also does not decide by itself that a candidate should be retained, accepted or delivered. The human invokes the move; the Workplace owns the resulting state.
Why a protocol instead of more prompts
A protocol can declare what conforming implementations must preserve:
- the Card’s identity;
- accepted and produced object kinds;
- duration and lifecycle;
- controls that may block or require approval;
- whether a move transforms, annotates, presents or acts;
- the semantic result passed to the next Card.
This gives implementations a shared contract that can be tested across providers without pretending that their command syntaxes are the same thing.
HACP Card human-invoked command contract
HACP Control session state governing resolution
Codex Skill one provider surface
Claude Command another provider surface
runtime code optional execution mechanism
Open Workplace and HACP
I keep the projects separate because they own different layers.
Open Workplace defines the workplace model
Endroit implements it in local files and projections
HACP defines explicit moves and controls
Runtime owns execution
Site owns external permission and truth
Human owns direction, judgment and promotion
A provider or harness may keep session history and hot state. It does not own the Workplace continuity. Endroit separates that durable place from the providers that execute inside it; HACP remains only an optional language for explicit moves.
A Home-native deck can compose with Endroit moves such as:
- call an Occupant;
- adopt a Role;
- activate Equipment;
- retain Material;
- accept a decision;
- deliver through a Route.
The same baseline also exposes human verbs for entering the Home or a Room,
working on a Site, retaining and accepting Material, delivering it, archiving
it, and running maintain-the-home. These are Endroit projections. They do not
make HACP a prerequisite or turn ordinary conversation into a command language.
They also make maintenance concrete. Once rules, Material, methods and destinations have distinct owners, Hygiene can explain an ambiguity without repairing it implicitly.
Conversation remains the interface
HACP leaves ordinary conversation untouched unless the human plays a Card or a persistent control remains active.
Use an explicit Card when the move itself needs a stable contract: a deep thinking operation, an approval boundary, a persistent control or a delivery effect. Do not force a Card around every act of reasoning.
Explicit Cards make consequential moves inspectable without turning every sentence into a command.
A dated account of how these boundaries work in practice appears in I Gave My Agents a Workplace.
Draft status
HACP is an open protocol in Draft 0.4. Its
SPEC.md
is normative. This article is explanatory.
The useful test is whether independent decks and providers can preserve the same declared meaning without acquiring more authority than the human gave them.